Joe Sandbox Cloud Basic Analysis Report

Loading ...

Play interactive tourEdit tour

Windows Analysis Report TNT Documents.exe

Overview

General Information

Sample Name:TNT Documents.exe
Analysis ID:528770
MD5:53213cdc9809c6debebe6400a4d1a891
SHA1:2383fe2e296a1f28deb600cfeadb0a3fa18856f3
SHA256:f49a87b9fa0e2e84273ad690ffe6d7548d7ed13a595fd4addf7c6211b0eb5108
Tags:exeFormbookTNT
Infos:

Most interesting Screenshot:

Detection

FormBook
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Self deletion via cmd delete
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
Executable has a suspicious name (potential lure to open the executable)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

Process Tree

  • System is w10x64
  • TNT Documents.exe (PID: 6612 cmdline: "C:\Users\user\Desktop\TNT Documents.exe" MD5: 53213CDC9809C6DEBEBE6400A4D1A891)
    • TNT Documents.exe (PID: 6040 cmdline: {path} MD5: 53213CDC9809C6DEBEBE6400A4D1A891)
      • explorer.exe (PID: 3424 cmdline: C:\Windows\Explorer.EXE MD5: AD5296B280E8F522A8A897C96BAB0E1D)
      • autoconv.exe (PID: 6884 cmdline: C:\Windows\SysWOW64\autoconv.exe MD5: 4506BE56787EDCD771A351C10B5AE3B7)
      • msdt.exe (PID: 6076 cmdline: C:\Windows\SysWOW64\msdt.exe MD5: 7F0C51DBA69B9DE5DDF6AA04CE3A69F4)
        • cmd.exe (PID: 5964 cmdline: /c del "C:\Users\user\Desktop\TNT Documents.exe" MD5: F3BDBE3BB6F734E357235F4D5898582D)
          • conhost.exe (PID: 6684 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)
        • explorer.exe (PID: 3240 cmdline: "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS MD5: AD5296B280E8F522A8A897C96BAB0E1D)
  • cleanup

Malware Configuration

Threatname: FormBook

{"C2 list": ["www.floridanratraining.com/how6/"], "decoy": ["wealthcabana.com", "fourfortyfourcreations.com", "cqqcsy.com", "bhwzjd.com", "niftyfashionrewards.com", "andersongiftemporium.com", "smarttradingcoin.com", "ilarealty.com", "sherrywine.net", "fsecg.info", "xoti.top", "pirosconsulting.com", "fundapie.com", "bbgm4egda.xyz", "legalfortmyers.com", "improvizy.com", "yxdyhs.com", "lucky2balls.com", "panelmall.com", "davenportkartway.com", "springfieldlottery.com", "pentagonpublishers.com", "icanmakeyoufamous.com", "40m2k.com", "projectcentered.com", "webfactory.agency", "metronixmedical.com", "dalingtao.xyz", "functionalsoft.com", "klopert77.com", "cortepuroiberico.com", "viavelleiloes.online", "bamedia.online", "skolicalunjo.com", "kayhardy.com", "excellentappraisers.com", "sademakale.com", "zbycsb.com", "empirejewelss.com", "coached.info", "20215414.online", "dazzlehide.com", "swickstyle.com", "specialtyplastics.online", "noordinarysenior.com", "bluinfo.digital", "chuxiaoxin.xyz", "adwin-estate.com", "girlwithaglow.com", "auctions.email", "topekasecurestorage.com", "mountain-chicken.com", "lhdtrj.com", "mhtqph.club", "solatopotato.com", "mecitiris.com", "hotrodathangtrungquoc.com", "gapteknews.com", "mantraexchange.online", "cinematiccarpenter.com", "wozka.xyz", "car-tech.tech", "jssatchell.media", "joyokanji-cheer.com"]}

Yara Overview

Memory Dumps

SourceRuleDescriptionAuthorStrings
00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
    00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
    • 0x8618:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x89b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
    • 0x146c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
    • 0x141b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
    • 0x147c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
    • 0x1493f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
    • 0x93ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
    • 0x1342c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
    • 0xa142:$sequence_7: 66 89 0C 02 5B 8B E5 5D
    • 0x19bb7:$sequence_8: 3C 54 74 04 3C 74 75 F4
    • 0x1ac5a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
    00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmpFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
    • 0x16ae9:$sqlite3step: 68 34 1C 7B E1
    • 0x16bfc:$sqlite3step: 68 34 1C 7B E1
    • 0x16b18:$sqlite3text: 68 38 2A 90 C5
    • 0x16c3d:$sqlite3text: 68 38 2A 90 C5
    • 0x16b2b:$sqlite3blob: 68 53 D8 7F 8C
    • 0x16c53:$sqlite3blob: 68 53 D8 7F 8C
    0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmpJoeSecurity_FormBookYara detected FormBookJoe Security
      0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmpFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
      • 0x8618:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x89b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
      • 0x146c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
      • 0x141b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
      • 0x147c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
      • 0x1493f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
      • 0x93ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
      • 0x1342c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
      • 0xa142:$sequence_7: 66 89 0C 02 5B 8B E5 5D
      • 0x19bb7:$sequence_8: 3C 54 74 04 3C 74 75 F4
      • 0x1ac5a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
      Click to see the 31 entries

      Unpacked PEs

      SourceRuleDescriptionAuthorStrings
      4.0.TNT Documents.exe.400000.8.raw.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
        4.0.TNT Documents.exe.400000.8.raw.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
        • 0x8618:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x89b2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
        • 0x146c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
        • 0x141b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
        • 0x147c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
        • 0x1493f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
        • 0x93ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
        • 0x1342c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
        • 0xa142:$sequence_7: 66 89 0C 02 5B 8B E5 5D
        • 0x19bb7:$sequence_8: 3C 54 74 04 3C 74 75 F4
        • 0x1ac5a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
        4.0.TNT Documents.exe.400000.8.raw.unpackFormbookdetect Formbook in memoryJPCERT/CC Incident Response Group
        • 0x16ae9:$sqlite3step: 68 34 1C 7B E1
        • 0x16bfc:$sqlite3step: 68 34 1C 7B E1
        • 0x16b18:$sqlite3text: 68 38 2A 90 C5
        • 0x16c3d:$sqlite3text: 68 38 2A 90 C5
        • 0x16b2b:$sqlite3blob: 68 53 D8 7F 8C
        • 0x16c53:$sqlite3blob: 68 53 D8 7F 8C
        4.2.TNT Documents.exe.400000.0.unpackJoeSecurity_FormBookYara detected FormBookJoe Security
          4.2.TNT Documents.exe.400000.0.unpackFormbook_1autogenerated rule brought to you by yara-signatorFelix Bilstein - yara-signator at cocacoding dot com
          • 0x7818:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x7bb2:$sequence_0: 03 C8 0F 31 2B C1 89 45 FC
          • 0x138c5:$sequence_1: 3C 24 0F 84 76 FF FF FF 3C 25 74 94
          • 0x133b1:$sequence_2: 3B 4F 14 73 95 85 C9 74 91
          • 0x139c7:$sequence_3: 3C 69 75 44 8B 7D 18 8B 0F
          • 0x13b3f:$sequence_4: 5D C3 8D 50 7C 80 FA 07
          • 0x85ca:$sequence_5: 0F BE 5C 0E 01 0F B6 54 0E 02 83 E3 0F C1 EA 06
          • 0x1262c:$sequence_6: 57 89 45 FC 89 45 F4 89 45 F8
          • 0x9342:$sequence_7: 66 89 0C 02 5B 8B E5 5D
          • 0x18db7:$sequence_8: 3C 54 74 04 3C 74 75 F4
          • 0x19e5a:$sequence_9: 56 68 03 01 00 00 8D 85 95 FE FF FF 6A 00
          Click to see the 19 entries

          Sigma Overview

          System Summary:

          barindex
          Sigma detected: Possible Applocker BypassShow sources
          Source: Process startedAuthor: juju4: Data: Command: C:\Windows\SysWOW64\msdt.exe, CommandLine: C:\Windows\SysWOW64\msdt.exe, CommandLine|base64offset|contains: , Image: C:\Windows\SysWOW64\msdt.exe, NewProcessName: C:\Windows\SysWOW64\msdt.exe, OriginalFileName: C:\Windows\SysWOW64\msdt.exe, ParentCommandLine: {path}, ParentImage: C:\Users\user\Desktop\TNT Documents.exe, ParentProcessId: 6040, ProcessCommandLine: C:\Windows\SysWOW64\msdt.exe, ProcessId: 6076

          Jbx Signature Overview

          Click to jump to signature section

          Show All Signature Results

          AV Detection:

          barindex
          Found malware configurationShow sources
          Source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmpMalware Configuration Extractor: FormBook {"C2 list": ["www.floridanratraining.com/how6/"], "decoy": ["wealthcabana.com", "fourfortyfourcreations.com", "cqqcsy.com", "bhwzjd.com", "niftyfashionrewards.com", "andersongiftemporium.com", "smarttradingcoin.com", "ilarealty.com", "sherrywine.net", "fsecg.info", "xoti.top", "pirosconsulting.com", "fundapie.com", "bbgm4egda.xyz", "legalfortmyers.com", "improvizy.com", "yxdyhs.com", "lucky2balls.com", "panelmall.com", "davenportkartway.com", "springfieldlottery.com", "pentagonpublishers.com", "icanmakeyoufamous.com", "40m2k.com", "projectcentered.com", "webfactory.agency", "metronixmedical.com", "dalingtao.xyz", "functionalsoft.com", "klopert77.com", "cortepuroiberico.com", "viavelleiloes.online", "bamedia.online", "skolicalunjo.com", "kayhardy.com", "excellentappraisers.com", "sademakale.com", "zbycsb.com", "empirejewelss.com", "coached.info", "20215414.online", "dazzlehide.com", "swickstyle.com", "specialtyplastics.online", "noordinarysenior.com", "bluinfo.digital", "chuxiaoxin.xyz", "adwin-estate.com", "girlwithaglow.com", "auctions.email", "topekasecurestorage.com", "mountain-chicken.com", "lhdtrj.com", "mhtqph.club", "solatopotato.com", "mecitiris.com", "hotrodathangtrungquoc.com", "gapteknews.com", "mantraexchange.online", "cinematiccarpenter.com", "wozka.xyz", "car-tech.tech", "jssatchell.media", "joyokanji-cheer.com"]}
          Multi AV Scanner detection for submitted fileShow sources
          Source: TNT Documents.exeReversingLabs: Detection: 48%
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.8.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.TNT Documents.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.8.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.TNT Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.TNT Documents.exe.3fd4e40.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, type: MEMORY
          Machine Learning detection for sampleShow sources
          Source: TNT Documents.exeJoe Sandbox ML: detected
          Source: 4.2.TNT Documents.exe.400000.0.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 4.0.TNT Documents.exe.400000.8.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 4.0.TNT Documents.exe.400000.4.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: 4.0.TNT Documents.exe.400000.6.unpackAvira: Label: TR/Crypt.ZPACK.Gen
          Source: TNT Documents.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
          Source: TNT Documents.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: msdt.pdbGCTL source: TNT Documents.exe, 00000004.00000002.800029853.0000000003300000.00000040.00020000.sdmp
          Source: Binary string: wntdll.pdbUGP source: TNT Documents.exe, 00000004.00000002.798924978.00000000012A0000.00000040.00000001.sdmp, TNT Documents.exe, 00000004.00000002.799089348.00000000013BF000.00000040.00000001.sdmp, msdt.exe, 0000000B.00000002.963153362.0000000004B40000.00000040.00000001.sdmp, msdt.exe, 0000000B.00000002.963364250.0000000004C5F000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: TNT Documents.exe, TNT Documents.exe, 00000004.00000002.798924978.00000000012A0000.00000040.00000001.sdmp, TNT Documents.exe, 00000004.00000002.799089348.00000000013BF000.00000040.00000001.sdmp, msdt.exe, msdt.exe, 0000000B.00000002.963153362.0000000004B40000.00000040.00000001.sdmp, msdt.exe, 0000000B.00000002.963364250.0000000004C5F000.00000040.00000001.sdmp
          Source: Binary string: msdt.pdb source: TNT Documents.exe, 00000004.00000002.800029853.0000000003300000.00000040.00020000.sdmp
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4x nop then pop edi
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4x nop then pop edi
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 4x nop then pop edi
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 4x nop then pop edi

          Networking:

          barindex
          C2 URLs / IPs found in malware configurationShow sources
          Source: Malware configuration extractorURLs: www.floridanratraining.com/how6/
          Source: explorer.exe, 00000016.00000003.917756477.0000000006088000.00000004.00000001.sdmp, explorer.exe, 00000016.00000002.953694318.0000000006088000.00000004.00000001.sdmp, explorer.exe, 00000016.00000000.919652524.0000000006088000.00000004.00000001.sdmpString found in binary or memory: http://crl.globalsign.net/root-r2.crl0
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://fontfabrik.com
          Source: explorer.exe, 00000016.00000002.949450560.0000000002AC2000.00000004.00000001.sdmp, explorer.exe, 00000016.00000000.897794439.0000000002AC2000.00000004.00000001.sdmpString found in binary or memory: http://ns.adobp
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.carterandcone.coml
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/?
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers8
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designers?
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fontbureau.com/designersG
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.fonts.com
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/bThe
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.founder.com.cn/cn/cThe
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/DPlease
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.goodfont.co.kr
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.jiyu-kobo.co.jp/
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.sajatypeworks.com
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.sakkal.com
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.sandoll.co.kr
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.tiro.com
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.typography.netD
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.urwpp.deDPlease
          Source: TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpString found in binary or memory: http://www.zhongyicts.com.cn

          E-Banking Fraud:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.8.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.TNT Documents.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.8.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.TNT Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.TNT Documents.exe.3fd4e40.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, type: MEMORY

          System Summary:

          barindex
          Malicious sample detected (through community Yara rule)Show sources
          Source: 4.0.TNT Documents.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.0.TNT Documents.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.TNT Documents.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.TNT Documents.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.0.TNT Documents.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.0.TNT Documents.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.0.TNT Documents.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.0.TNT Documents.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.2.TNT Documents.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.2.TNT Documents.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0.2.TNT Documents.exe.3fd4e40.1.raw.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0.2.TNT Documents.exe.3fd4e40.1.raw.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.0.TNT Documents.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.0.TNT Documents.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 4.0.TNT Documents.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 4.0.TNT Documents.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, type: MEMORYMatched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
          Source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, type: MEMORYMatched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
          Source: Process Memory Space: explorer.exe PID: 3424, type: MEMORYSTRMatched rule: Semi-Auto-generated - file ironshell.php.txt Author: Neo23x0 Yara BRG + customization by Stefan -dfate- Molls
          Initial sample is a PE file and has a suspicious nameShow sources
          Source: initial sampleStatic PE information: Filename: TNT Documents.exe
          Executable has a suspicious name (potential lure to open the executable)Show sources
          Source: TNT Documents.exeStatic file information: Suspicious name
          Source: TNT Documents.exeStatic PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
          Source: 4.0.TNT Documents.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.0.TNT Documents.exe.400000.8.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.TNT Documents.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.TNT Documents.exe.400000.0.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.0.TNT Documents.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.0.TNT Documents.exe.400000.6.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.0.TNT Documents.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.0.TNT Documents.exe.400000.8.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.2.TNT Documents.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.2.TNT Documents.exe.400000.0.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0.2.TNT Documents.exe.3fd4e40.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0.2.TNT Documents.exe.3fd4e40.1.raw.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.0.TNT Documents.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.0.TNT Documents.exe.400000.4.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 4.0.TNT Documents.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 4.0.TNT Documents.exe.400000.6.unpack, type: UNPACKEDPEMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
          Source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, type: MEMORYMatched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
          Source: Process Memory Space: explorer.exe PID: 3424, type: MEMORYSTRMatched rule: ironshell_php author = Neo23x0 Yara BRG + customization by Stefan -dfate- Molls, description = Semi-Auto-generated - file ironshell.php.txt, hash = 8bfa2eeb8a3ff6afc619258e39fded56
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_014ED7BC
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_014EE210
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_014EE220
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_014EBD54
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_014EFC91
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F0F78
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F1700
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F9F30
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075FCF80
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075FA5E8
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F2118
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F0040
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F3010
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F5800
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F57FA
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F2FEA
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075FD650
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F5608
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F3ED8
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F3EC8
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F16F0
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F9698
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F55F8
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F4D90
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F4D81
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F1C10
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F1C20
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075FCC80
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F6350
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F634B
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075FA3C8
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F5399
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F53A8
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075FBAF0
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F4A90
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F4A81
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F2109
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F5138
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F5129
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F0006
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00401030
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00408C8B
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00408C90
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00402D87
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00402D90
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00402FB0
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E4120
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CF900
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0139E824
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381002
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F20A0
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013920A8
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DB090
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013928EC
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01392B28
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EAB40
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FEBB0
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013803DA
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138DBD2
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0137FA2B
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013922AE
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C0D20
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01392D07
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01391D55
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2581
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DD5E0
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013925DD
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D841F
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138D466
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01391FF1
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0139DFCE
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E6E30
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138D616
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01392EF7
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2D466
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7841F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C325DD
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B92581
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C22D82
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7D5E0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B60D20
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C31D55
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C32D07
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C32EF7
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B86E30
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2D616
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C3DFCE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C31FF1
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B920A0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7B090
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C328EC
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C320A8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8A830
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21002
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C3E824
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B899BF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B84120
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B6F900
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24AEF
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C322AE
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B236
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C1FA2B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9EBB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2DBD2
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C203DA
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C123E3
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9138B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9ABD8
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C0CB4F
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8A309
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C32B28
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8AB40
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007A8C90
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007A8C8B
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007A2D90
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007A2D87
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007A2FB0
          Source: C:\Windows\SysWOW64\msdt.exeCode function: String function: 04B6B150 appears 136 times
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: String function: 012CB150 appears 45 times
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_004185F0 NtCreateFile,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_004186A0 NtReadFile,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00418720 NtClose,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_004187D0 NtAllocateVirtualMemory,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_004185EA NtCreateFile,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00418642 NtReadFile,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0041869A NtReadFile,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_004187CB NtAllocateVirtualMemory,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309910 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013099A0 NtCreateSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309840 NtDelayExecution,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013098F0 NtReadVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309A20 NtResumeThread,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309A00 NtProtectVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309A50 NtCreateFile,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309540 NtReadFile,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013095D0 NtClose,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309710 NtQueryInformationToken,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013097A0 NtUnmapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309780 NtMapViewOfSection,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309FE0 NtCreateMutant,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309660 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013096E0 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309950 NtQueueApcThread,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013099D0 NtCreateProcessEx,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309820 NtEnumerateKey,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0130B040 NtSuspendThread,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013098A0 NtWriteVirtualMemory,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309B00 NtSetValueKey,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0130A3B0 NtGetContextThread,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309A10 NtQuerySection,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309A80 NtOpenDirectoryObject,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0130AD30 NtSetContextThread,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309520 NtWaitForSingleObject,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309560 NtWriteFile,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013095F0 NtQueryInformationFile,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309730 NtQueryVirtualMemory,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0130A710 NtOpenProcessToken,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0130A770 NtOpenThread,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309770 NtSetInformationFile,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309760 NtOpenProcess,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309610 NtEnumerateValueKey,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309670 NtQueryInformationProcess,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01309650 NtQueryValueKey,
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013096D0 NtCreateKey,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA95D0 NtClose,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9540 NtReadFile,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA96E0 NtFreeVirtualMemory,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA96D0 NtCreateKey,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9660 NtAllocateVirtualMemory,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9650 NtQueryValueKey,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9780 NtMapViewOfSection,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9FE0 NtCreateMutant,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9710 NtQueryInformationToken,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9860 NtQuerySystemInformation,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9840 NtDelayExecution,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA99A0 NtCreateSection,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9910 NtAdjustPrivilegesToken,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9A50 NtCreateFile,LdrInitializeThunk,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA95F0 NtQueryInformationFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BAAD30 NtSetContextThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9520 NtWaitForSingleObject,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9560 NtWriteFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9610 NtEnumerateValueKey,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9670 NtQueryInformationProcess,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA97A0 NtUnmapViewOfSection,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9730 NtQueryVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BAA710 NtOpenProcessToken,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BAA770 NtOpenThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9770 NtSetInformationFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9760 NtOpenProcess,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA98A0 NtWriteVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA98F0 NtReadVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9820 NtEnumerateKey,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BAB040 NtSuspendThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA99D0 NtCreateProcessEx,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9950 NtQueueApcThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9A80 NtOpenDirectoryObject,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9A20 NtResumeThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9A10 NtQuerySection,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9A00 NtProtectVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BAA3B0 NtGetContextThread,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA9B00 NtSetValueKey,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B85F0 NtCreateFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B86A0 NtReadFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B8720 NtClose,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B87D0 NtAllocateVirtualMemory,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B85EA NtCreateFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B8642 NtReadFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B869A NtReadFile,
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B87CB NtAllocateVirtualMemory,
          Source: TNT Documents.exe, 00000000.00000000.672866618.0000000000BA2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameZpiiIoA.exe@ vs TNT Documents.exe
          Source: TNT Documents.exe, 00000000.00000002.711592915.0000000007550000.00000004.00020000.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs TNT Documents.exe
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs TNT Documents.exe
          Source: TNT Documents.exe, 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmpBinary or memory string: OriginalFilenameMajorRevision.exe< vs TNT Documents.exe
          Source: TNT Documents.exe, 00000004.00000002.798576124.00000000008F2000.00000002.00020000.sdmpBinary or memory string: OriginalFilenameZpiiIoA.exe@ vs TNT Documents.exe
          Source: TNT Documents.exe, 00000004.00000002.799435118.000000000154F000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs TNT Documents.exe
          Source: TNT Documents.exe, 00000004.00000002.800029853.0000000003300000.00000040.00020000.sdmpBinary or memory string: OriginalFilenamemsdt.exej% vs TNT Documents.exe
          Source: TNT Documents.exe, 00000004.00000002.799089348.00000000013BF000.00000040.00000001.sdmpBinary or memory string: OriginalFilenamentdll.dllj% vs TNT Documents.exe
          Source: TNT Documents.exeBinary or memory string: OriginalFilenameZpiiIoA.exe@ vs TNT Documents.exe
          Source: TNT Documents.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: TNT Documents.exeReversingLabs: Detection: 48%
          Source: TNT Documents.exeStatic PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
          Source: C:\Users\user\Desktop\TNT Documents.exeKey opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers
          Source: unknownProcess created: C:\Users\user\Desktop\TNT Documents.exe "C:\Users\user\Desktop\TNT Documents.exe"
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Users\user\Desktop\TNT Documents.exe {path}
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\TNT Documents.exe"
          Source: C:\Windows\SysWOW64\cmd.exeProcess created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Users\user\Desktop\TNT Documents.exe {path}
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\TNT Documents.exe"
          Source: C:\Windows\explorer.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{660b90c8-73a9-4b58-8cae-355b7f55341b}\InProcServer32
          Source: C:\Users\user\Desktop\TNT Documents.exeFile created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TNT Documents.exe.logJump to behavior
          Source: classification engineClassification label: mal100.troj.evad.winEXE@11/1@0/1
          Source: C:\Windows\explorer.exeFile read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.iniJump to behavior
          Source: C:\Users\user\Desktop\TNT Documents.exeSection loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll
          Source: C:\Windows\System32\conhost.exeMutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6684:120:WilError_01
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\explorer.exe
          Source: Window RecorderWindow detected: More than 3 window changes detected
          Source: C:\Users\user\Desktop\TNT Documents.exeFile opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll
          Source: TNT Documents.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
          Source: TNT Documents.exeStatic PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
          Source: Binary string: msdt.pdbGCTL source: TNT Documents.exe, 00000004.00000002.800029853.0000000003300000.00000040.00020000.sdmp
          Source: Binary string: wntdll.pdbUGP source: TNT Documents.exe, 00000004.00000002.798924978.00000000012A0000.00000040.00000001.sdmp, TNT Documents.exe, 00000004.00000002.799089348.00000000013BF000.00000040.00000001.sdmp, msdt.exe, 0000000B.00000002.963153362.0000000004B40000.00000040.00000001.sdmp, msdt.exe, 0000000B.00000002.963364250.0000000004C5F000.00000040.00000001.sdmp
          Source: Binary string: wntdll.pdb source: TNT Documents.exe, TNT Documents.exe, 00000004.00000002.798924978.00000000012A0000.00000040.00000001.sdmp, TNT Documents.exe, 00000004.00000002.799089348.00000000013BF000.00000040.00000001.sdmp, msdt.exe, msdt.exe, 0000000B.00000002.963153362.0000000004B40000.00000040.00000001.sdmp, msdt.exe, 0000000B.00000002.963364250.0000000004C5F000.00000040.00000001.sdmp
          Source: Binary string: msdt.pdb source: TNT Documents.exe, 00000004.00000002.800029853.0000000003300000.00000040.00020000.sdmp

          Data Obfuscation:

          barindex
          .NET source code contains potential unpackerShow sources
          Source: TNT Documents.exe, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 0.2.TNT Documents.exe.b40000.0.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 0.0.TNT Documents.exe.b40000.0.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 4.0.TNT Documents.exe.890000.9.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 4.0.TNT Documents.exe.890000.1.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 4.2.TNT Documents.exe.890000.1.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 4.0.TNT Documents.exe.890000.7.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 4.0.TNT Documents.exe.890000.5.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 4.0.TNT Documents.exe.890000.0.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 4.0.TNT Documents.exe.890000.3.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: 4.0.TNT Documents.exe.890000.2.unpack, u0006u2000.cs.Net Code: \x02 System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F2D4A push ds; ret
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 0_2_075F61E6 push esi; iretd
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0041B832 push eax; ret
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0041B83B push eax; ret
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0041B89C push eax; ret
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0040825A push ecx; retf
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0040C38A pushfd ; ret
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00415CC4 push FFFFFFDFh; iretd
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0041B7E5 push eax; ret
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0131D0D1 push ecx; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BBD0D1 push ecx; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007BB83B push eax; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007BB832 push eax; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007BB89C push eax; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007A825A push ecx; retf
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007AC38A pushfd ; ret
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007B5CC4 push FFFFFFDFh; iretd
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_007BB7E5 push eax; ret
          Source: initial sampleStatic PE information: section name: .text entropy: 7.96472261238

          Hooking and other Techniques for Hiding and Protection:

          barindex
          Self deletion via cmd deleteShow sources
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: /c del "C:\Users\user\Desktop\TNT Documents.exe"
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: /c del "C:\Users\user\Desktop\TNT Documents.exe"
          Source: C:\Windows\explorer.exeRegistry key monitored for changes: HKEY_CURRENT_USER_Classes
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\SysWOW64\msdt.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX
          Source: C:\Windows\explorer.exeProcess information set: NOOPENFILEERRORBOX

          Malware Analysis System Evasion:

          barindex
          Yara detected AntiVM3Show sources
          Source: Yara matchFile source: 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: Process Memory Space: TNT Documents.exe PID: 6612, type: MEMORYSTR
          Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)Show sources
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: WINE_GET_UNIX_FILE_NAME
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: SBIEDLL.DLL
          Tries to detect virtualization through RDTSC time measurementsShow sources
          Source: C:\Users\user\Desktop\TNT Documents.exeRDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\TNT Documents.exeRDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 00000000007A8614 second address: 00000000007A861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Windows\SysWOW64\msdt.exeRDTSC instruction interceptor: First address: 00000000007A89AE second address: 00000000007A89B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
          Source: C:\Users\user\Desktop\TNT Documents.exe TID: 6604Thread sleep time: -922337203685477s >= -30000s
          Source: C:\Windows\SysWOW64\msdt.exeLast function: Thread delayed
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_004088E0 rdtsc
          Source: C:\Users\user\Desktop\TNT Documents.exeThread delayed: delay time: 922337203685477
          Source: C:\Windows\explorer.exeFile opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess information queried: ProcessInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeThread delayed: delay time: 922337203685477
          Source: explorer.exe, 00000016.00000003.896977047.0000000005E33000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000016.00000002.954468782.00000000062AF000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B/b
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: explorer.exe, 00000005.00000000.731842532.000000000A60E000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000016.00000000.916170667.0000000005D10000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 00000016.00000003.917202739.0000000006211000.00000004.00000001.sdmpBinary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:z
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: VMWARE
          Source: explorer.exe, 00000016.00000000.919652524.0000000006088000.00000004.00000001.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
          Source: explorer.exe, 00000016.00000000.916170667.0000000005D10000.00000004.00000001.sdmpBinary or memory string: NECVMWarVMware SATA CD001.00WBX
          Source: explorer.exe, 00000016.00000002.952762008.0000000005E33000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}57
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
          Source: explorer.exe, 00000005.00000000.706742776.0000000004710000.00000004.00000001.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
          Source: explorer.exe, 00000005.00000000.732035177.000000000A716000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
          Source: explorer.exe, 00000016.00000003.927230518.00000000062CA000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}z
          Source: explorer.exe, 00000005.00000000.732035177.000000000A716000.00000004.00000001.sdmpBinary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
          Source: explorer.exe, 00000016.00000002.954563148.00000000062C9000.00000004.00000001.sdmpBinary or memory string: ?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: VMware SVGA IIOData Source=localhost\sqlexpress;Initial Catalog=dbSMS;Integrated Security=True
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: vmware
          Source: explorer.exe, 00000016.00000000.917365906.0000000005E33000.00000004.00000001.sdmpBinary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
          Source: explorer.exe, 00000016.00000003.917440283.000000000621D000.00000004.00000001.sdmpBinary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000016.00000000.919652524.0000000006088000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00
          Source: explorer.exe, 00000016.00000002.952509808.0000000005D10000.00000004.00000001.sdmpBinary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
          Source: explorer.exe, 00000016.00000002.954468782.00000000062AF000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B0a
          Source: explorer.exe, 00000016.00000002.953555804.0000000005FBE000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}y
          Source: explorer.exe, 00000016.00000002.952762008.0000000005E33000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ZR
          Source: explorer.exe, 00000016.00000003.913114176.0000000006088000.00000004.00000001.sdmpBinary or memory string: \\?\SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b}iFWO
          Source: explorer.exe, 00000016.00000000.913874864.000000000490A000.00000004.00000001.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Z
          Source: explorer.exe, 00000016.00000003.937526972.00000000062CA000.00000004.00000001.sdmpBinary or memory string: \?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000016.00000002.952762008.0000000005E33000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}/
          Source: explorer.exe, 00000005.00000000.732035177.000000000A716000.00000004.00000001.sdmpBinary or memory string: War&Prod_VMware_SATAa
          Source: explorer.exe, 00000016.00000002.954468782.00000000062AF000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BFb
          Source: explorer.exe, 00000016.00000002.954468782.00000000062AF000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
          Source: explorer.exe, 00000016.00000002.952762008.0000000005E33000.00000004.00000001.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000$a
          Source: explorer.exe, 00000016.00000003.913065851.0000000006051000.00000004.00000001.sdmpBinary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000i@v
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: VMware SVGA II
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
          Source: explorer.exe, 00000016.00000002.952762008.0000000005E33000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}<
          Source: explorer.exe, 00000016.00000002.953555804.0000000005FBE000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}exe
          Source: explorer.exe, 00000005.00000000.732733430.000000000A9D4000.00000004.00000001.sdmpBinary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000016.00000002.953555804.0000000005FBE000.00000004.00000001.sdmpBinary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000016.00000003.927230518.00000000062CA000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000016.00000003.934085252.0000000006196000.00000004.00000001.sdmpBinary or memory string: VMware SATA CD00dRom0K
          Source: explorer.exe, 00000016.00000002.954468782.00000000062AF000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BKa
          Source: TNT Documents.exe, 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmpBinary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
          Source: explorer.exe, 00000005.00000000.751220813.0000000006650000.00000004.00000001.sdmpBinary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
          Source: explorer.exe, 00000005.00000000.716107547.000000000A83C000.00000004.00000001.sdmpBinary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}((
          Source: explorer.exe, 00000016.00000002.948738356.00000000009A8000.00000004.00000020.sdmpBinary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_004088E0 rdtsc
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess token adjusted: Debug
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E4120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E4120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E4120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E4120 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E4120 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F513A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C9100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C9100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C9100 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CC962 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CB171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CB171 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EB944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EB944 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013451BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013451BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013451BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013451BE mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F61A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F61A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013469A6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013849A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013849A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013849A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013849A4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FA185 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EC182 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2990 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CB1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CB1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CB1E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013541E8 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DB02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DB02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DB02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DB02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01347016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01347016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01347016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01394015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01394015 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01382073 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01391074 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E0050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E0050 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F20A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FF0BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FF0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FF0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013090AF mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C9080 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01343884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01343884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C58EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C40E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C40E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C40E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135B8D0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135B8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138131B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CDB60 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F3B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F3B7A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01398B58 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CDB40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CF358 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F4BAD mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01395BA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D1B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D1B8F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138138A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0137D380 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2397 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FB390 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EDBE9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F03E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013453CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013453CA mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01304A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01304A2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D8A0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138AA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E3A1C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CAA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CAA16 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C5210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C5210 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C5210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C5210 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0130927A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0137B260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0137B260 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01398A62 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01354257 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C9240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C9240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C9240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C9240 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138EA55 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C52A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C52A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C52A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C52A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C52A5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DAAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DAAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FFAB0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FD294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FD294 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2AE4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2ACB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138E539 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0134A537 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01398D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F4D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D3D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CAD30 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EC577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EC577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01303D43 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01343540 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01373D40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E7D50 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F35A1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013905AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013905AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F1DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C2D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C2D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C2D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C2D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C2D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F2581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FFD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FFD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01378DF1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DD5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DD5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346DC9 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FBC2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0139740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0139740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0139740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012E746D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FA44B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135C450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135C450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D849B mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013814FB mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01346CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01398CD6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C4F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012C4F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FE730 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FA70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FA70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135FF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135FF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0139070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0139070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EF716 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DFF60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01398F6A mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012DEF40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01347794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01347794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01347794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D8794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013037F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0137FE3F mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CE620 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CC600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CC600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012CC600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F8E00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01381608 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FA61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012FA61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D766D mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EAE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EAE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EAE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EAE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012EAE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D7E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D7E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D7E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D7E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D7E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D7E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138AE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0138AE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_013446A7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01390EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01390EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01390EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0135FE87 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F16E0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012D76E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_012F36CC mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01398ED6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_0137FEC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_01308EC7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C38CD6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7849B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C214FB mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6CF0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C24496 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9BC2C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6C0A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9AC7B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21C06 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C3740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C3740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C3740D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B477 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8746D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFC450 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9A44B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B91DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B91DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B91DB5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B935A1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2FDE2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9FD9B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C18DF1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B92581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B92581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B92581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B92581 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B62D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B62D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B62D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B62D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B62D8A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C22D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C22D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C22D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C22D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C22D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C22D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C22D82 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7D5E0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C305AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C305AC mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6DC9 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE6DC9 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C13D40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B94D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B94D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B94D3B mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B73D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B6AD30 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BEA537 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8C577 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B87D50 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C38D34 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA3D43 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2E539 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE3540 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C1FEC0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C38ED6 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE46A7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFFE87 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B776E2 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B916E0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C30EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C30EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C30EA5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B936CC mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA8EC7 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2AE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C2AE44 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B6E620 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9A61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9A61C mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B6C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B6C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B6C600 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B98E00 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C21608 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8AE73 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7766D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B77E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B77E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B77E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B77E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B77E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B77E41 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C1FE3F mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B78794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE7794 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA37F5 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B73D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B73D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9E730 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B64F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B64F2E mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C38F6A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8F716 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFFF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFFF10 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9A70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9A70E mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C3070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04C3070D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7FF60 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7EF40 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9F0BF mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9F0BF mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BA90AF mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B920A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B920A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B920A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B920A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B920A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B920A0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B69080 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE3884 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B640E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B640E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B640E1 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B658EC mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B8E4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8B8E4 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFB8D0 mov ecx, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BFB8D0 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B8A830 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B9002D mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04B7B02A mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Windows\SysWOW64\msdt.exeCode function: 11_2_04BE7016 mov eax, dword ptr fs:[00000030h]
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess queried: DebugPort
          Source: C:\Windows\SysWOW64\msdt.exeProcess queried: DebugPort
          Source: C:\Users\user\Desktop\TNT Documents.exeCode function: 4_2_00409B50 LdrLoadDll,
          Source: C:\Users\user\Desktop\TNT Documents.exeMemory allocated: page read and write | page guard

          HIPS / PFW / Operating System Protection Evasion:

          barindex
          Sample uses process hollowing techniqueShow sources
          Source: C:\Users\user\Desktop\TNT Documents.exeSection unmapped: C:\Windows\SysWOW64\msdt.exe base address: AF0000
          Maps a DLL or memory area into another processShow sources
          Source: C:\Users\user\Desktop\TNT Documents.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\TNT Documents.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\TNT Documents.exeSection loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write
          Source: C:\Users\user\Desktop\TNT Documents.exeSection loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: unknown target: unknown protection: read write
          Source: C:\Windows\SysWOW64\msdt.exeSection loaded: unknown target: C:\Windows\explorer.exe protection: read write
          Injects a PE file into a foreign processesShow sources
          Source: C:\Users\user\Desktop\TNT Documents.exeMemory written: C:\Users\user\Desktop\TNT Documents.exe base: 400000 value starts with: 4D5A
          Queues an APC in another process (thread injection)Show sources
          Source: C:\Users\user\Desktop\TNT Documents.exeThread APC queued: target process: C:\Windows\explorer.exe
          Modifies the context of a thread in another process (thread injection)Show sources
          Source: C:\Users\user\Desktop\TNT Documents.exeThread register set: target process: 3424
          Source: C:\Users\user\Desktop\TNT Documents.exeThread register set: target process: 3424
          Source: C:\Windows\SysWOW64\msdt.exeThread register set: target process: 3424
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Users\user\Desktop\TNT Documents.exe {path}
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
          Source: C:\Users\user\Desktop\TNT Documents.exeProcess created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
          Source: C:\Windows\SysWOW64\msdt.exeProcess created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\TNT Documents.exe"
          Source: explorer.exe, 00000005.00000000.703001557.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.741298041.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.723648727.0000000000AD8000.00000004.00000020.sdmpBinary or memory string: ProgmanMD6
          Source: explorer.exe, 00000005.00000000.741554838.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.703397323.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.723934007.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.897311916.0000000000F60000.00000002.00020000.sdmpBinary or memory string: Program Manager
          Source: explorer.exe, 00000005.00000000.751203315.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.741554838.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.703397323.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.723934007.0000000001080000.00000002.00020000.sdmp, msdt.exe, 0000000B.00000002.962670648.0000000003260000.00000002.00020000.sdmp, explorer.exe, 00000016.00000002.949118423.0000000000F60000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.897311916.0000000000F60000.00000002.00020000.sdmpBinary or memory string: Shell_TrayWnd
          Source: explorer.exe, 00000005.00000000.741554838.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.703397323.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.723934007.0000000001080000.00000002.00020000.sdmp, msdt.exe, 0000000B.00000002.962670648.0000000003260000.00000002.00020000.sdmp, explorer.exe, 00000016.00000002.949118423.0000000000F60000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.909358004.0000000004820000.00000004.00000001.sdmp, explorer.exe, 00000016.00000000.897311916.0000000000F60000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.915617522.0000000005390000.00000004.00000001.sdmp, explorer.exe, 00000016.00000000.896757718.00000000009A8000.00000004.00000020.sdmp, explorer.exe, 00000016.00000002.948738356.00000000009A8000.00000004.00000020.sdmp, explorer.exe, 00000016.00000002.952445897.0000000005390000.00000004.00000001.sdmp, explorer.exe, 00000016.00000002.951318587.0000000004820000.00000004.00000001.sdmpBinary or memory string: Progman
          Source: explorer.exe, 00000005.00000000.741554838.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.703397323.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.723934007.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.897311916.0000000000F60000.00000002.00020000.sdmpBinary or memory string: Progmanlock
          Source: msdt.exe, 0000000B.00000002.962670648.0000000003260000.00000002.00020000.sdmp, explorer.exe, 00000016.00000002.949118423.0000000000F60000.00000002.00020000.sdmp, explorer.exe, 00000016.00000000.897311916.0000000000F60000.00000002.00020000.sdmpBinary or memory string: wProgram Manager
          Source: explorer.exe, 00000005.00000000.715669791.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.754186189.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.732035177.000000000A716000.00000004.00000001.sdmpBinary or memory string: Shell_TrayWnd5D
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Users\user\Desktop\TNT Documents.exe VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeQueries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation
          Source: C:\Users\user\Desktop\TNT Documents.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

          Stealing of Sensitive Information:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.8.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.TNT Documents.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.8.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.TNT Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.TNT Documents.exe.3fd4e40.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, type: MEMORY

          Remote Access Functionality:

          barindex
          Yara detected FormBookShow sources
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.8.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.TNT Documents.exe.400000.0.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.6.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.8.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.2.TNT Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 0.2.TNT Documents.exe.3fd4e40.1.raw.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.4.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 4.0.TNT Documents.exe.400000.6.unpack, type: UNPACKEDPE
          Source: Yara matchFile source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, type: MEMORY
          Source: Yara matchFile source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, type: MEMORY

          Mitre Att&ck Matrix

          Initial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionExfiltrationCommand and ControlNetwork EffectsRemote Service EffectsImpact
          Valid AccountsShared Modules1Path InterceptionProcess Injection512Masquerading1OS Credential DumpingQuery Registry1Remote ServicesArchive Collected Data1Exfiltration Over Other Network MediumEncrypted Channel1Eavesdrop on Insecure Network CommunicationRemotely Track Device Without AuthorizationModify System Partition
          Default AccountsScheduled Task/JobBoot or Logon Initialization ScriptsBoot or Logon Initialization ScriptsDisable or Modify Tools1LSASS MemorySecurity Software Discovery231Remote Desktop ProtocolData from Removable MediaExfiltration Over BluetoothApplication Layer Protocol1Exploit SS7 to Redirect Phone Calls/SMSRemotely Wipe Data Without AuthorizationDevice Lockout
          Domain AccountsAt (Linux)Logon Script (Windows)Logon Script (Windows)Virtualization/Sandbox Evasion41Security Account ManagerProcess Discovery2SMB/Windows Admin SharesData from Network Shared DriveAutomated ExfiltrationSteganographyExploit SS7 to Track Device LocationObtain Device Cloud BackupsDelete Device Data
          Local AccountsAt (Windows)Logon Script (Mac)Logon Script (Mac)Process Injection512NTDSVirtualization/Sandbox Evasion41Distributed Component Object ModelInput CaptureScheduled TransferProtocol ImpersonationSIM Card SwapCarrier Billing Fraud
          Cloud AccountsCronNetwork Logon ScriptNetwork Logon ScriptDeobfuscate/Decode Files or Information1LSA SecretsFile and Directory Discovery1SSHKeyloggingData Transfer Size LimitsFallback ChannelsManipulate Device CommunicationManipulate App Store Rankings or Ratings
          Replication Through Removable MediaLaunchdRc.commonRc.commonObfuscated Files or Information4Cached Domain CredentialsSystem Information Discovery112VNCGUI Input CaptureExfiltration Over C2 ChannelMultiband CommunicationJamming or Denial of ServiceAbuse Accessibility Features
          External Remote ServicesScheduled TaskStartup ItemsStartup ItemsSoftware Packing13DCSyncNetwork SniffingWindows Remote ManagementWeb Portal CaptureExfiltration Over Alternative ProtocolCommonly Used PortRogue Wi-Fi Access PointsData Encrypted for Impact
          Drive-by CompromiseCommand and Scripting InterpreterScheduled Task/JobScheduled Task/JobFile Deletion1Proc FilesystemNetwork Service ScanningShared WebrootCredential API HookingExfiltration Over Symmetric Encrypted Non-C2 ProtocolApplication Layer ProtocolDowngrade to Insecure ProtocolsGenerate Fraudulent Advertising Revenue

          Behavior Graph

          Hide Legend

          Legend:

          • Process
          • Signature
          • Created File
          • DNS/IP Info
          • Is Dropped
          • Is Windows Process
          • Number of created Registry Values
          • Number of created Files
          • Visual Basic
          • Delphi
          • Java
          • .Net C# or VB.NET
          • C, C++ or other language
          • Is malicious
          • Internet
          behaviorgraph top1 signatures2 2 Behavior Graph ID: 528770 Sample: TNT Documents.exe Startdate: 25/11/2021 Architecture: WINDOWS Score: 100 42 Found malware configuration 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 Multi AV Scanner detection for submitted file 2->46 48 9 other signatures 2->48 9 TNT Documents.exe 3 2->9         started        process3 file4 30 C:\Users\user\...\TNT Documents.exe.log, ASCII 9->30 dropped 50 Injects a PE file into a foreign processes 9->50 13 TNT Documents.exe 9->13         started        signatures5 process6 signatures7 52 Modifies the context of a thread in another process (thread injection) 13->52 54 Maps a DLL or memory area into another process 13->54 56 Sample uses process hollowing technique 13->56 58 Queues an APC in another process (thread injection) 13->58 16 msdt.exe 13->16         started        19 explorer.exe 13->19 injected 21 autoconv.exe 13->21         started        process8 signatures9 34 Self deletion via cmd delete 16->34 36 Modifies the context of a thread in another process (thread injection) 16->36 38 Maps a DLL or memory area into another process 16->38 40 Tries to detect virtualization through RDTSC time measurements 16->40 23 explorer.exe 1 145 16->23         started        26 cmd.exe 1 16->26         started        process10 dnsIp11 32 192.168.2.1 unknown unknown 23->32 28 conhost.exe 26->28         started        process12

          Screenshots

          Thumbnails

          This section contains all screenshots as thumbnails, including those not shown in the slideshow.

          windows-stand

          Antivirus, Machine Learning and Genetic Malware Detection

          Initial Sample

          SourceDetectionScannerLabelLink
          TNT Documents.exe49%ReversingLabsByteCode-MSIL.Trojan.AgentTesla
          TNT Documents.exe100%Joe Sandbox ML

          Dropped Files

          No Antivirus matches

          Unpacked PE Files

          SourceDetectionScannerLabelLinkDownload
          4.2.TNT Documents.exe.400000.0.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          4.0.TNT Documents.exe.400000.8.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          4.0.TNT Documents.exe.400000.4.unpack100%AviraTR/Crypt.ZPACK.GenDownload File
          4.0.TNT Documents.exe.400000.6.unpack100%AviraTR/Crypt.ZPACK.GenDownload File

          Domains

          No Antivirus matches

          URLs

          SourceDetectionScannerLabelLink
          http://www.founder.com.cn/cn/bThe0%URL Reputationsafe
          http://www.tiro.com0%URL Reputationsafe
          http://www.goodfont.co.kr0%URL Reputationsafe
          http://www.carterandcone.coml0%URL Reputationsafe
          http://www.sajatypeworks.com0%URL Reputationsafe
          www.floridanratraining.com/how6/0%Avira URL Cloudsafe
          http://www.typography.netD0%URL Reputationsafe
          http://www.founder.com.cn/cn/cThe0%URL Reputationsafe
          http://www.galapagosdesign.com/staff/dennis.htm0%URL Reputationsafe
          http://fontfabrik.com0%URL Reputationsafe
          http://www.founder.com.cn/cn0%URL Reputationsafe
          http://ns.adobp0%Avira URL Cloudsafe
          http://www.jiyu-kobo.co.jp/0%URL Reputationsafe
          http://www.galapagosdesign.com/DPlease0%URL Reputationsafe
          http://www.sandoll.co.kr0%URL Reputationsafe
          http://www.urwpp.deDPlease0%URL Reputationsafe
          http://www.zhongyicts.com.cn0%URL Reputationsafe
          http://www.sakkal.com0%URL Reputationsafe

          Domains and IPs

          Contacted Domains

          No contacted domains info

          Contacted URLs

          NameMaliciousAntivirus DetectionReputation
          www.floridanratraining.com/how6/true
          • Avira URL Cloud: safe
          		low

          URLs from Memory and Binaries

          NameSourceMaliciousAntivirus DetectionReputation
          http://www.apache.org/licenses/LICENSE-2.0TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
            		high
            http://www.fontbureau.comTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
              		high
              http://www.fontbureau.com/designersGTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                		high
                http://www.fontbureau.com/designers/?TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                  		high
                  http://www.founder.com.cn/cn/bTheTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                  • URL Reputation: safe
                  		unknown
                  http://www.fontbureau.com/designers?TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                    		high
                    http://www.tiro.comTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                    • URL Reputation: safe
                    		unknown
                    http://www.fontbureau.com/designersTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                      		high
                      http://www.goodfont.co.krTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.carterandcone.comlTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.sajatypeworks.comTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.typography.netDTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                      • URL Reputation: safe
                      		unknown
                      http://www.fontbureau.com/designers/cabarga.htmlNTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                        		high
                        http://www.founder.com.cn/cn/cTheTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.galapagosdesign.com/staff/dennis.htmTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://fontfabrik.comTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.founder.com.cn/cnTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                        • URL Reputation: safe
                        		unknown
                        http://www.fontbureau.com/designers/frere-user.htmlTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                          		high
                          http://ns.adobpexplorer.exe, 00000016.00000002.949450560.0000000002AC2000.00000004.00000001.sdmp, explorer.exe, 00000016.00000000.897794439.0000000002AC2000.00000004.00000001.sdmpfalse
                          • Avira URL Cloud: safe
                          		unknown
                          http://www.jiyu-kobo.co.jp/TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.galapagosdesign.com/DPleaseTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                          • URL Reputation: safe
                          		unknown
                          http://www.fontbureau.com/designers8TNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                            		high
                            http://www.fonts.comTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                              		high
                              http://www.sandoll.co.krTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.urwpp.deDPleaseTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.zhongyicts.com.cnTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown
                              http://www.sakkal.comTNT Documents.exe, 00000000.00000002.711284893.0000000007032000.00000004.00000001.sdmpfalse
                              • URL Reputation: safe
                              		unknown

                              Contacted IPs

                              • No. of IPs < 25%
                              • 25% < No. of IPs < 50%
                              • 50% < No. of IPs < 75%
                              • 75% < No. of IPs

                              Public

                              IPDomainCountryFlagASNASN NameMalicious

                              Private

                              IP
                              192.168.2.1

                              General Information

                              Joe Sandbox Version:34.0.0 Boulder Opal
                              Analysis ID:528770
                              Start date:25.11.2021
                              Start time:18:49:10
                              Joe Sandbox Product:CloudBasic
                              Overall analysis duration:0h 11m 22s
                              Hypervisor based Inspection enabled:false
                              Report type:light
                              Sample file name:TNT Documents.exe
                              Cookbook file name:default.jbs
                              Analysis system description:Windows 10 64 bit v1803 with Office Professional Plus 2016, Chrome 85, IE 11, Adobe Reader DC 19, Java 8 Update 211
                              Number of analysed new started processes analysed:27
                              Number of new started drivers analysed:0
                              Number of existing processes analysed:0
                              Number of existing drivers analysed:0
                              Number of injected processes analysed:1
                              Technologies:
                              • HCA enabled
                              • EGA enabled
                              • HDC enabled
                              • AMSI enabled
                              Analysis Mode:default
                              Analysis stop reason:Timeout
                              Detection:MAL
                              Classification:mal100.troj.evad.winEXE@11/1@0/1
                              EGA Information:Failed
                              HDC Information:
                              • Successful, ratio: 11.6% (good quality ratio 10.6%)
                              • Quality average: 74.9%
                              • Quality standard deviation: 30.2%
                              HCA Information:
                              • Successful, ratio: 97%
                              • Number of executed functions: 0
                              • Number of non-executed functions: 0
                              Cookbook Comments:
                              • Adjust boot time
                              • Enable AMSI
                              • Found application associated with file extension: .exe
                              Warnings:
                              Show All
                              • Exclude process from analysis (whitelisted): SearchUI.exe, BackgroundTransferHost.exe, WerFault.exe, ShellExperienceHost.exe, backgroundTaskHost.exe, svchost.exe, mobsync.exe, wuapihost.exe
                              • Excluded domains from analysis (whitelisted): ris.api.iris.microsoft.com, www.bing.com, store-images.s-microsoft.com, ctldl.windowsupdate.com, displaycatalog.mp.microsoft.com, img-prod-cms-rt-microsoft-com.akamaized.net, arc.msn.com
                              • Not all processes where analyzed, report is missing behavior information
                              • Report size exceeded maximum capacity and may have missing behavior information.
                              • Report size getting too big, too many NtAllocateVirtualMemory calls found.
                              • Report size getting too big, too many NtCreateFile calls found.
                              • Report size getting too big, too many NtEnumerateKey calls found.
                              • Report size getting too big, too many NtEnumerateValueKey calls found.
                              • Report size getting too big, too many NtOpenKeyEx calls found.
                              • Report size getting too big, too many NtProtectVirtualMemory calls found.
                              • Report size getting too big, too many NtQueryAttributesFile calls found.
                              • Report size getting too big, too many NtQueryValueKey calls found.

                              Simulations

                              Behavior and APIs

                              TimeTypeDescription
                              18:50:19API Interceptor1x Sleep call for process: TNT Documents.exe modified
                              18:51:48API Interceptor76x Sleep call for process: explorer.exe modified

                              Joe Sandbox View / Context

                              IPs

                              No context

                              Domains

                              No context

                              ASN

                              No context

                              JA3 Fingerprints

                              No context

                              Dropped Files

                              No context

                              Created / dropped Files

                              C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\TNT Documents.exe.log
                              Process:C:\Users\user\Desktop\TNT Documents.exe
                              File Type:ASCII text, with CRLF line terminators
                              Category:dropped
                              Size (bytes):1216
                              Entropy (8bit):5.355304211458859
                              Encrypted:false
                              SSDEEP:24:MLUE4K5E4Ks2E1qE4x84qXKDE4KhK3VZ9pKhPKIE4oKFKHKoZAE4Kzr7FE4j:MIHK5HKXE1qHxviYHKhQnoPtHoxHhAHY
                              MD5:69206D3AF7D6EFD08F4B4726998856D3
                              SHA1:E778D4BF781F7712163CF5E2F5E7C15953E484CF
                              SHA-256:A937AD22F9C3E667A062BA0E116672960CD93522F6997C77C00370755929BA87
                              SHA-512:CD270C3DF75E548C9B0727F13F44F45262BD474336E89AAEBE56FABFE8076CD4638F88D3C0837B67C2EB3C54055679B07E4212FB3FEDBF88C015EB5DBBCD7FF8
                              Malicious:true
                              Reputation:high, very likely benign file
                              Preview: 1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\4f0a7eefa3cd3e0ba98b5ebddbbc72e6\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..2,"Microsoft.VisualBasic, Version=10.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\f1d8480152e0da9a60ad49c6d16a3b6d\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\8d67d92724ba494b6c7fd089d6f25b48\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a

                              Static File Info

                              General

                              File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
                              Entropy (8bit):7.955416061350034
                              TrID:
                              • Win32 Executable (generic) Net Framework (10011505/4) 49.83%
                              • Win32 Executable (generic) a (10002005/4) 49.78%
                              • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
                              • Generic Win/DOS Executable (2004/3) 0.01%
                              • DOS Executable Generic (2002/1) 0.01%
                              File name:TNT Documents.exe
                              File size:390656
                              MD5:53213cdc9809c6debebe6400a4d1a891
                              SHA1:2383fe2e296a1f28deb600cfeadb0a3fa18856f3
                              SHA256:f49a87b9fa0e2e84273ad690ffe6d7548d7ed13a595fd4addf7c6211b0eb5108
                              SHA512:7dd498aeaeaa092c37adad278b2847d2b7712635aedcdec1c4ecd8789523ba4b9995dc14b7e5c1bf5130f55edba5e611d8e78f621a38c7bba11bf379d3a6f6de
                              SSDEEP:6144:tdu3v3Ur+0zBbMStodHnsU/IvlLhGj+bTmHlBfJ5HCoTPtUm84YMfN:tdu3Pm+0zRopB8Gj+b0trioTXfN
                              File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......a................................. ... ....@.. .......................`............@................................

                              File Icon

                              Icon Hash:00828e8e8686b000

                              Static PE Info

                              General

                              Entrypoint:0x460b0e
                              Entrypoint Section:.text
                              Digitally signed:false
                              Imagebase:0x400000
                              Subsystem:windows gui
                              Image File Characteristics:LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
                              DLL Characteristics:NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
                              Time Stamp:0x619EEFA3 [Thu Nov 25 02:06:27 2021 UTC]
                              TLS Callbacks:
                              CLR (.Net) Version:v4.0.30319
                              OS Version Major:4
                              OS Version Minor:0
                              File Version Major:4
                              File Version Minor:0
                              Subsystem Version Major:4
                              Subsystem Version Minor:0
                              Import Hash:f34d5f2d4577ed6d9ceec516c1f5a744

                              Entrypoint Preview

                              Instruction
                              jmp dword ptr [00402000h]
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al
                              add byte ptr [eax], al

                              Data Directories

                              NameVirtual AddressVirtual Size Is in Section
                              IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IMPORT0x60ab40x57.text
                              IMAGE_DIRECTORY_ENTRY_RESOURCE0x620000x580.rsrc
                              IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
                              IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
                              IMAGE_DIRECTORY_ENTRY_BASERELOC0x640000xc.reloc
                              IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
                              IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
                              IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
                              IMAGE_DIRECTORY_ENTRY_TLS0x00x0
                              IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
                              IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
                              IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
                              IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
                              IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

                              Sections

                              NameVirtual AddressVirtual SizeRaw SizeXored PEZLIB ComplexityFile TypeEntropyCharacteristics
                              .text0x20000x5eb140x5ec00False0.962746330805SysEx File - AKG7.96472261238IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
                              .rsrc0x620000x5800x600False0.419270833333data4.43335713516IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
                              .reloc0x640000xc0x200False0.044921875data0.0815394123432IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

                              Resources

                              NameRVASizeTypeLanguageCountry
                              RT_VERSION0x620a00x32cdata
                              RT_MANIFEST0x623cc0x1b4XML 1.0 document, UTF-8 Unicode (with BOM) text, with very long lines, with no line terminators

                              Imports

                              DLLImport
                              mscoree.dll_CorExeMain

                              Version Infos

                              DescriptionData
                              Translation0x0000 0x04b0
                              LegalCopyrightCopyright 2011
                              Assembly Version1.0.0.0
                              InternalNameZpiiIoA.exe
                              FileVersion1.0.0.0
                              CompanyName
                              LegalTrademarks
                              Comments
                              ProductNameFileReplacement
                              ProductVersion1.0.0.0
                              FileDescriptionFileReplacement
                              OriginalFilenameZpiiIoA.exe

                              Network Behavior

                              No network behavior found

                              Code Manipulations

                              Statistics

                              Behavior

                              Click to jump to process

                              System Behavior

                              Analysis Process: TNT Documents.exe PID: 6612 Parent PID: 5444

                              General

                              Start time:18:50:10
                              Start date:25/11/2021
                              Path:C:\Users\user\Desktop\TNT Documents.exe
                              Wow64 process (32bit):true
                              Commandline:"C:\Users\user\Desktop\TNT Documents.exe"
                              Imagebase:0xb40000
                              File size:390656 bytes
                              MD5 hash:53213CDC9809C6DEBEBE6400A4D1A891
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:.Net C# or VB.NET
                              Yara matches:
                              • Rule: JoeSecurity_AntiVM_3, Description: Yara detected AntiVM_3, Source: 00000000.00000002.703985087.0000000003206000.00000004.00000001.sdmp, Author: Joe Security
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000000.00000002.707439158.0000000003F39000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                              Reputation:low

                              Analysis Process: TNT Documents.exe PID: 6040 Parent PID: 6612

                              General

                              Start time:18:50:21
                              Start date:25/11/2021
                              Path:C:\Users\user\Desktop\TNT Documents.exe
                              Wow64 process (32bit):true
                              Commandline:{path}
                              Imagebase:0x890000
                              File size:390656 bytes
                              MD5 hash:53213CDC9809C6DEBEBE6400A4D1A891
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.798434648.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.698679096.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.799493056.00000000015D0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000002.798798288.0000000000E30000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000004.00000000.699262494.0000000000400000.00000040.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                              Reputation:low

                              Analysis Process: explorer.exe PID: 3424 Parent PID: 6040

                              General

                              Start time:18:50:24
                              Start date:25/11/2021
                              Path:C:\Windows\explorer.exe
                              Wow64 process (32bit):false
                              Commandline:C:\Windows\Explorer.EXE
                              Imagebase:0x7ff6fee60000
                              File size:3933184 bytes
                              MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.756647993.000000000E4CE000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 00000005.00000000.735741697.000000000E4CE000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                              Reputation:high

                              Analysis Process: autoconv.exe PID: 6884 Parent PID: 6040

                              General

                              Start time:18:51:04
                              Start date:25/11/2021
                              Path:C:\Windows\SysWOW64\autoconv.exe
                              Wow64 process (32bit):false
                              Commandline:C:\Windows\SysWOW64\autoconv.exe
                              Imagebase:0x960000
                              File size:851968 bytes
                              MD5 hash:4506BE56787EDCD771A351C10B5AE3B7
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:moderate

                              Analysis Process: msdt.exe PID: 6076 Parent PID: 6040

                              General

                              Start time:18:51:06
                              Start date:25/11/2021
                              Path:C:\Windows\SysWOW64\msdt.exe
                              Wow64 process (32bit):true
                              Commandline:C:\Windows\SysWOW64\msdt.exe
                              Imagebase:0xaf0000
                              File size:1508352 bytes
                              MD5 hash:7F0C51DBA69B9DE5DDF6AA04CE3A69F4
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Yara matches:
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.962732138.0000000004670000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.960597354.00000000007A0000.00000040.00020000.sdmp, Author: JPCERT/CC Incident Response Group
                              • Rule: JoeSecurity_FormBook, Description: Yara detected FormBook, Source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, Author: Joe Security
                              • Rule: Formbook_1, Description: autogenerated rule brought to you by yara-signator, Source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, Author: Felix Bilstein - yara-signator at cocacoding dot com
                              • Rule: Formbook, Description: detect Formbook in memory, Source: 0000000B.00000002.962868450.0000000004800000.00000004.00000001.sdmp, Author: JPCERT/CC Incident Response Group
                              Reputation:moderate

                              Analysis Process: cmd.exe PID: 5964 Parent PID: 6076

                              General

                              Start time:18:51:10
                              Start date:25/11/2021
                              Path:C:\Windows\SysWOW64\cmd.exe
                              Wow64 process (32bit):true
                              Commandline:/c del "C:\Users\user\Desktop\TNT Documents.exe"
                              Imagebase:0x11d0000
                              File size:232960 bytes
                              MD5 hash:F3BDBE3BB6F734E357235F4D5898582D
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:high

                              Analysis Process: conhost.exe PID: 6684 Parent PID: 5964

                              General

                              Start time:18:51:11
                              Start date:25/11/2021
                              Path:C:\Windows\System32\conhost.exe
                              Wow64 process (32bit):false
                              Commandline:C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
                              Imagebase:0x7ff724c50000
                              File size:625664 bytes
                              MD5 hash:EA777DEEA782E8B4D7C7C33BBF8A4496
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:high

                              Analysis Process: explorer.exe PID: 3240 Parent PID: 5252

                              General

                              Start time:18:51:47
                              Start date:25/11/2021
                              Path:C:\Windows\explorer.exe
                              Wow64 process (32bit):false
                              Commandline:"C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
                              Imagebase:0x7ff6fee60000
                              File size:3933184 bytes
                              MD5 hash:AD5296B280E8F522A8A897C96BAB0E1D
                              Has elevated privileges:true
                              Has administrator privileges:true
                              Programmed in:C, C++ or other language
                              Reputation:high

                              Disassembly

                              Code Analysis

                              Reset < >