Windows Analysis Report 52h0KETBXt.exe

Overview

General Information

Sample Name: 52h0KETBXt.exe
Analysis ID: 552749
MD5: c0fed64dae580efb8fb8308accf76cac
SHA1: d7de3d945c5e62ee8f7b77a508b8b0682cae713d
SHA256: 5bd07db2eed6c7e67e3f3947b5336c6ba986cfbd03bd406c13eda1999a64fc70
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Multi AV Scanner detection for domain / URL
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Self deletion via cmd delete
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
.NET source code contains method to dynamically call methods (often used by packers)
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Abnormal high CPU Usage
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Tries to load missing DLLs
Contains functionality to read the PEB
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.hstolchsjybyl.com/a83r/"], "decoy": ["comercializadoralonso.com", "durhamschoolservces.com", "onegreencapital.com", "smartcities24.com", "maquinas.store", "brianlovesbonsai.com", "xin41518s.com", "moneyearnus.xyz", "be-mix.com", "fengyat.club", "inspectdecided.xyz", "paksafpakistan.com", "orhidlnt.top", "princesuraj.com", "vietnamvodka.com", "renewnow.site", "imageservices.xyz", "luxurytravelfranchise.com", "kp112.red", "royalyorkfirewood.com", "azharrizvi.com", "mtvamazon.com", "stlouisplatinumhomes.com", "ke6rkmtn.xyz", "roomviser.xyz", "rollcalloutfitters.com", "jlautoparts.net", "swipyy.xyz", "handymansaltlakecity.com", "tuespr.com", "prelink.xyz", "whrpky037.xyz", "yoga-4-health.com", "silvermoonandcompany.com", "meg-roh.com", "81218121.com", "prayerteamusa.com", "ocejxu.com", "lopeyhomeimporvementservice.com", "dcosearchandconnect.xyz", "md-newspages.online", "elinmex.online", "traineriq.com", "feministecologies.com", "gyltogether.com", "polyversed.com", "rodolforios.com", "bcfs0l.com", "51dmm.com", "metaverselivecasinos.com", "csjsgk.com", "impactincentivesregistry.com", "firekim.space", "jdzn.xyz", "d6ybf7yj.xyz", "sturt.xyz", "serious-cam.com", "stihl-gms.com", "gentleman5.xyz", "rustbeltcoders.net", "hmarketsed96.com", "cricfreelive.com", "wellyounow.com", "fwdrow.com"]}
Multi AV Scanner detection for submitted file
Source: 52h0KETBXt.exe Virustotal: Detection: 33% Perma Link
Source: 52h0KETBXt.exe ReversingLabs: Detection: 39%
Yara detected FormBook
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.52h0KETBXt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.52h0KETBXt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.929865713.0000000000470000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.740647599.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.741087450.0000000000A30000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.713850034.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.679919351.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.741186169.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.729857444.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.932677156.0000000002840000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.932951022.0000000002940000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp, type: MEMORY
Multi AV Scanner detection for domain / URL
Source: www.hstolchsjybyl.com/a83r/ Virustotal: Detection: 5% Perma Link
Machine Learning detection for sample
Source: 52h0KETBXt.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 2.2.52h0KETBXt.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.52h0KETBXt.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.52h0KETBXt.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.52h0KETBXt.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: 52h0KETBXt.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: 52h0KETBXt.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: systray.pdb source: 52h0KETBXt.exe, 00000002.00000002.741057292.0000000000A10000.00000040.00020000.sdmp
Source: Binary string: systray.pdbGCTL source: 52h0KETBXt.exe, 00000002.00000002.741057292.0000000000A10000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: 52h0KETBXt.exe, 00000002.00000002.741255425.0000000000EA0000.00000040.00000001.sdmp, 52h0KETBXt.exe, 00000002.00000002.741563789.0000000000FBF000.00000040.00000001.sdmp, systray.exe, 00000007.00000002.934124002.0000000004760000.00000040.00000001.sdmp, systray.exe, 00000007.00000002.934415770.000000000487F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 52h0KETBXt.exe, 00000002.00000002.741255425.0000000000EA0000.00000040.00000001.sdmp, 52h0KETBXt.exe, 00000002.00000002.741563789.0000000000FBF000.00000040.00000001.sdmp, systray.exe, systray.exe, 00000007.00000002.934124002.0000000004760000.00000040.00000001.sdmp, systray.exe, 00000007.00000002.934415770.000000000487F000.00000040.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 4x nop then pop esi 2_2_004172FD
Source: C:\Windows\SysWOW64\systray.exe Code function: 4x nop then pop esi 7_2_029572FD

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.hstolchsjybyl.com/a83r/
Source: explorer.exe, 00000011.00000000.834267617.00000000008F7000.00000004.00000020.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: 52h0KETBXt.exe, 00000001.00000003.659840508.0000000005845000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.659900419.0000000005845000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.659871289.0000000005846000.00000004.00000001.sdmp String found in binary or memory: http://en.w
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: 52h0KETBXt.exe, 00000001.00000003.661359025.0000000005847000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.664631137.0000000005846000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.662971751.0000000005845000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: 52h0KETBXt.exe, 00000001.00000003.661509000.0000000005846000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.com
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: 52h0KETBXt.exe, 00000001.00000003.661509000.0000000005846000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.como.?
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: 52h0KETBXt.exe, 00000001.00000003.665154267.000000000587D000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: 52h0KETBXt.exe, 00000001.00000003.666226019.000000000587D000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlP&
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: 52h0KETBXt.exe, 00000001.00000002.681883527.0000000000E47000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: 52h0KETBXt.exe, 00000001.00000002.681883527.0000000000E47000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.comiona
Source: 52h0KETBXt.exe, 00000001.00000002.681883527.0000000000E47000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.coml1
Source: 52h0KETBXt.exe, 00000001.00000002.681883527.0000000000E47000.00000004.00000040.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: 52h0KETBXt.exe, 00000001.00000003.661359025.0000000005847000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: 52h0KETBXt.exe, 00000001.00000003.661509000.0000000005846000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661311624.0000000005847000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661448122.0000000005846000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661191274.0000000005844000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661260196.0000000005846000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661386367.0000000005847000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661212364.0000000005844000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661359025.0000000005847000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cnK
Source: 52h0KETBXt.exe, 00000001.00000003.661509000.0000000005846000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661311624.0000000005847000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661448122.0000000005846000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661191274.0000000005844000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661260196.0000000005846000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661386367.0000000005847000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661212364.0000000005844000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.661359025.0000000005847000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cni
Source: 52h0KETBXt.exe, 00000001.00000003.668720087.0000000005875000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.668794708.0000000005875000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/1
Source: 52h0KETBXt.exe, 00000001.00000003.668720087.0000000005875000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000003.668794708.0000000005875000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/;
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: 52h0KETBXt.exe, 00000001.00000002.683532411.0000000006A52000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: 52h0KETBXt.exe, 00000001.00000003.661448122.0000000005846000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cno.

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: 52h0KETBXt.exe, 00000001.00000002.681699547.0000000000C9A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.52h0KETBXt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.52h0KETBXt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.929865713.0000000000470000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.740647599.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.741087450.0000000000A30000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.713850034.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.679919351.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.741186169.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.729857444.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.932677156.0000000002840000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.932951022.0000000002940000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 2.0.52h0KETBXt.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.52h0KETBXt.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.52h0KETBXt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.52h0KETBXt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.52h0KETBXt.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.52h0KETBXt.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.52h0KETBXt.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.52h0KETBXt.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.52h0KETBXt.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.52h0KETBXt.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.52h0KETBXt.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.52h0KETBXt.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.52h0KETBXt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.52h0KETBXt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.929865713.0000000000470000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.929865713.0000000000470000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.740647599.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.740647599.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.741087450.0000000000A30000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.741087450.0000000000A30000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.713850034.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.713850034.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.679919351.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.679919351.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.741186169.0000000000E60000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.741186169.0000000000E60000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.729857444.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.729857444.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.932677156.0000000002840000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.932677156.0000000002840000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.932951022.0000000002940000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.932951022.0000000002940000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: 52h0KETBXt.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 2.0.52h0KETBXt.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.52h0KETBXt.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.52h0KETBXt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.52h0KETBXt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.52h0KETBXt.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.52h0KETBXt.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.52h0KETBXt.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.52h0KETBXt.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.52h0KETBXt.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.52h0KETBXt.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.52h0KETBXt.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.52h0KETBXt.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.52h0KETBXt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.52h0KETBXt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.929865713.0000000000470000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.929865713.0000000000470000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.740647599.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.740647599.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.741087450.0000000000A30000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.741087450.0000000000A30000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.713850034.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.713850034.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.679919351.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.679919351.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.741186169.0000000000E60000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.741186169.0000000000E60000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.729857444.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.729857444.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.932677156.0000000002840000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.932677156.0000000002840000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.932951022.0000000002940000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.932951022.0000000002940000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_00C6E6B0 1_2_00C6E6B0
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_00C6C284 1_2_00C6C284
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_00C6E6AC 1_2_00C6E6AC
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041E876 2_2_0041E876
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041E47F 2_2_0041E47F
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041DDBE 2_2_0041DDBE
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00409E5B 2_2_00409E5B
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00409E60 2_2_00409E60
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041E622 2_2_0041E622
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479841F 7_2_0479841F
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484D466 7_2_0484D466
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04780D20 7_2_04780D20
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048525DD 7_2_048525DD
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04852D07 7_2_04852D07
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479D5E0 7_2_0479D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04851D55 7_2_04851D55
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2581 7_2_047B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A6E30 7_2_047A6E30
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04852EF7 7_2_04852EF7
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484D616 7_2_0484D616
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0485DFCE 7_2_0485DFCE
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04851FF1 7_2_04851FF1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048520A8 7_2_048520A8
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048528EC 7_2_048528EC
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841002 7_2_04841002
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0485E824 7_2_0485E824
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B20A0 7_2_047B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479B090 7_2_0479B090
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A4120 7_2_047A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478F900 7_2_0478F900
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048522AE 7_2_048522AE
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484DBD2 7_2_0484DBD2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048403DA 7_2_048403DA
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04852B28 7_2_04852B28
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BEBB0 7_2_047BEBB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295E876 7_2_0295E876
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295E622 7_2_0295E622
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_02949E5B 7_2_02949E5B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_02949E60 7_2_02949E60
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_02942FB0 7_2_02942FB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295E47F 7_2_0295E47F
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_02942D90 7_2_02942D90
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295DDB9 7_2_0295DDB9
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\systray.exe Code function: String function: 0478B150 appears 39 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041A370 NtCreateFile, 2_2_0041A370
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041A420 NtReadFile, 2_2_0041A420
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041A4A0 NtClose, 2_2_0041A4A0
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041A550 NtAllocateVirtualMemory, 2_2_0041A550
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041A41A NtReadFile, 2_2_0041A41A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9540 NtReadFile,LdrInitializeThunk, 7_2_047C9540
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C95D0 NtClose,LdrInitializeThunk, 7_2_047C95D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_047C9660
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9650 NtQueryValueKey,LdrInitializeThunk, 7_2_047C9650
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C96E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_047C96E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C96D0 NtCreateKey,LdrInitializeThunk, 7_2_047C96D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9710 NtQueryInformationToken,LdrInitializeThunk, 7_2_047C9710
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9FE0 NtCreateMutant,LdrInitializeThunk, 7_2_047C9FE0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9780 NtMapViewOfSection,LdrInitializeThunk, 7_2_047C9780
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_047C9860
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9840 NtDelayExecution,LdrInitializeThunk, 7_2_047C9840
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_047C9910
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C99A0 NtCreateSection,LdrInitializeThunk, 7_2_047C99A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9A50 NtCreateFile,LdrInitializeThunk, 7_2_047C9A50
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9560 NtWriteFile, 7_2_047C9560
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047CAD30 NtSetContextThread, 7_2_047CAD30
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9520 NtWaitForSingleObject, 7_2_047C9520
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C95F0 NtQueryInformationFile, 7_2_047C95F0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9670 NtQueryInformationProcess, 7_2_047C9670
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9610 NtEnumerateValueKey, 7_2_047C9610
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047CA770 NtOpenThread, 7_2_047CA770
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9770 NtSetInformationFile, 7_2_047C9770
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9760 NtOpenProcess, 7_2_047C9760
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9730 NtQueryVirtualMemory, 7_2_047C9730
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047CA710 NtOpenProcessToken, 7_2_047CA710
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C97A0 NtUnmapViewOfSection, 7_2_047C97A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047CB040 NtSuspendThread, 7_2_047CB040
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9820 NtEnumerateKey, 7_2_047C9820
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C98F0 NtReadVirtualMemory, 7_2_047C98F0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C98A0 NtWriteVirtualMemory, 7_2_047C98A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9950 NtQueueApcThread, 7_2_047C9950
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C99D0 NtCreateProcessEx, 7_2_047C99D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9A20 NtResumeThread, 7_2_047C9A20
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9A10 NtQuerySection, 7_2_047C9A10
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9A00 NtProtectVirtualMemory, 7_2_047C9A00
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9A80 NtOpenDirectoryObject, 7_2_047C9A80
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C9B00 NtSetValueKey, 7_2_047C9B00
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047CA3B0 NtGetContextThread, 7_2_047CA3B0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295A370 NtCreateFile, 7_2_0295A370
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295A4A0 NtClose, 7_2_0295A4A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295A420 NtReadFile, 7_2_0295A420
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295A550 NtAllocateVirtualMemory, 7_2_0295A550
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295A41A NtReadFile, 7_2_0295A41A
Abnormal high CPU Usage
Source: C:\Windows\explorer.exe Process Stats: CPU usage > 98%
Sample file is different than original file name gathered from version info
Source: 52h0KETBXt.exe, 00000001.00000002.681699547.0000000000C9A000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs 52h0KETBXt.exe
Source: 52h0KETBXt.exe, 00000001.00000002.685826170.0000000008CA0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs 52h0KETBXt.exe
Source: 52h0KETBXt.exe, 00000001.00000000.656176943.0000000000546000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSymLanguageVend.exe: vs 52h0KETBXt.exe
Source: 52h0KETBXt.exe, 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs 52h0KETBXt.exe
Source: 52h0KETBXt.exe, 00000002.00000000.678692482.00000000004A6000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameSymLanguageVend.exe: vs 52h0KETBXt.exe
Source: 52h0KETBXt.exe, 00000002.00000002.741563789.0000000000FBF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 52h0KETBXt.exe
Source: 52h0KETBXt.exe, 00000002.00000002.742451762.000000000114F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 52h0KETBXt.exe
Source: 52h0KETBXt.exe, 00000002.00000002.741068625.0000000000A13000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamesystray.exej% vs 52h0KETBXt.exe
Source: 52h0KETBXt.exe Binary or memory string: OriginalFilenameSymLanguageVend.exe: vs 52h0KETBXt.exe
Tries to load missing DLLs
Source: C:\Windows\explorer.exe Section loaded: usermgrproxy.dll Jump to behavior
Source: 52h0KETBXt.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 52h0KETBXt.exe Virustotal: Detection: 33%
Source: 52h0KETBXt.exe ReversingLabs: Detection: 39%
Source: 52h0KETBXt.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\52h0KETBXt.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\52h0KETBXt.exe "C:\Users\user\Desktop\52h0KETBXt.exe"
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process created: C:\Users\user\Desktop\52h0KETBXt.exe C:\Users\user\Desktop\52h0KETBXt.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autofmt.exe C:\Windows\SysWOW64\autofmt.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\autoconv.exe C:\Windows\SysWOW64\autoconv.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\52h0KETBXt.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process created: C:\Users\user\Desktop\52h0KETBXt.exe C:\Users\user\Desktop\52h0KETBXt.exe Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\52h0KETBXt.exe" Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{660b90c8-73a9-4b58-8cae-355b7f55341b}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\52h0KETBXt.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@10/1@0/1
Source: C:\Windows\explorer.exe File read: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5672:120:WilError_01
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\explorer.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\52h0KETBXt.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: 52h0KETBXt.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 52h0KETBXt.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: systray.pdb source: 52h0KETBXt.exe, 00000002.00000002.741057292.0000000000A10000.00000040.00020000.sdmp
Source: Binary string: systray.pdbGCTL source: 52h0KETBXt.exe, 00000002.00000002.741057292.0000000000A10000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: 52h0KETBXt.exe, 00000002.00000002.741255425.0000000000EA0000.00000040.00000001.sdmp, 52h0KETBXt.exe, 00000002.00000002.741563789.0000000000FBF000.00000040.00000001.sdmp, systray.exe, 00000007.00000002.934124002.0000000004760000.00000040.00000001.sdmp, systray.exe, 00000007.00000002.934415770.000000000487F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 52h0KETBXt.exe, 00000002.00000002.741255425.0000000000EA0000.00000040.00000001.sdmp, 52h0KETBXt.exe, 00000002.00000002.741563789.0000000000FBF000.00000040.00000001.sdmp, systray.exe, systray.exe, 00000007.00000002.934124002.0000000004760000.00000040.00000001.sdmp, systray.exe, 00000007.00000002.934415770.000000000487F000.00000040.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: 52h0KETBXt.exe, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.2.52h0KETBXt.exe.4d0000.0.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 1.0.52h0KETBXt.exe.4d0000.0.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.52h0KETBXt.exe.430000.1.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.52h0KETBXt.exe.430000.9.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.52h0KETBXt.exe.430000.1.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.52h0KETBXt.exe.430000.7.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.52h0KETBXt.exe.430000.2.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.52h0KETBXt.exe.430000.3.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.52h0KETBXt.exe.430000.5.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.52h0KETBXt.exe.430000.0.unpack, Auto_Machine/AutoMachine.cs .Net Code: P_000001 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
.NET source code contains method to dynamically call methods (often used by packers)
Source: 52h0KETBXt.exe, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 1.2.52h0KETBXt.exe.4d0000.0.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 1.0.52h0KETBXt.exe.4d0000.0.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 2.2.52h0KETBXt.exe.430000.1.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 2.0.52h0KETBXt.exe.430000.9.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 2.0.52h0KETBXt.exe.430000.1.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 2.0.52h0KETBXt.exe.430000.7.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 2.0.52h0KETBXt.exe.430000.2.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 2.0.52h0KETBXt.exe.430000.3.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 2.0.52h0KETBXt.exe.430000.5.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Source: 2.0.52h0KETBXt.exe.430000.0.unpack, Auto_Machine/AutoMachine.cs .Net Code: LateBinding.LateCall(V_5, null, "Invoke", new object[] { null, V_6 }, null, null)
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_004D7C61 push es; ret 1_2_004D7F94
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_004D66FC push ss; ret 1_2_004D6700
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_004D6804 push ds; ret 1_2_004D6808
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_004D6612 push es; ret 1_2_004D6628
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_004D7CAC push es; ret 1_2_004D7F94
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_004D6820 push es; ret 1_2_004D6826
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_004D6732 push es; ret 1_2_004D6736
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 1_2_04DE8190 push ecx; ret 1_2_04DE81A5
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041F074 push 0000003Ah; retf 2_2_0041F076
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041783E push 5B3B22F0h; retf 2_2_00417852
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041EA3B push E33F23DFh; ret 2_2_0041EA5E
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00416B72 push eax; retf 2_2_00416BE8
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041EC07 push 2AB056CEh; ret 2_2_0041ECC5
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041D4C5 push eax; ret 2_2_0041D518
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041ECC6 push 2AB056CEh; ret 2_2_0041ECC5
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041654F push esp; iretd 2_2_00416550
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041D57C push eax; ret 2_2_0041D582
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041D512 push eax; ret 2_2_0041D518
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041D51B push eax; ret 2_2_0041D582
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00416FF0 push edi; retf 2_2_0041700D
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0041A785 push esi; iretd 2_2_0041A786
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00436804 push ds; ret 2_2_00436808
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00436820 push es; ret 2_2_00436826
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00437E44 push es; ret 2_2_00437F94
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00436612 push es; ret 2_2_00436628
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_004366FC push ss; ret 2_2_00436700
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00436732 push es; ret 2_2_00436736
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047DD0D1 push ecx; ret 7_2_047DD0E4
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295EA3B push E33F23DFh; ret 7_2_0295EA5E
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_02956B72 push eax; retf 7_2_02956BE8
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0295783E push 5B3B22F0h; retf 7_2_02957852
Source: initial sample Static PE information: section name: .text entropy: 7.63059503702

Hooking and other Techniques for Hiding and Protection:

barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\systray.exe Process created: /c del "C:\Users\user\Desktop\52h0KETBXt.exe"
Source: C:\Windows\SysWOW64\systray.exe Process created: /c del "C:\Users\user\Desktop\52h0KETBXt.exe" Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\explorer.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 1.2.52h0KETBXt.exe.2981de4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.52h0KETBXt.exe.29eb64c.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.682151005.00000000028F1000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.682235184.0000000002994000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 52h0KETBXt.exe PID: 1360, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 52h0KETBXt.exe, 00000001.00000002.682151005.00000000028F1000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000002.682235184.0000000002994000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: 52h0KETBXt.exe, 00000001.00000002.682151005.00000000028F1000.00000004.00000001.sdmp, 52h0KETBXt.exe, 00000001.00000002.682235184.0000000002994000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\52h0KETBXt.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\52h0KETBXt.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe RDTSC instruction interceptor: First address: 0000000002949904 second address: 000000000294990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe RDTSC instruction interceptor: First address: 0000000002949B7E second address: 0000000002949B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\52h0KETBXt.exe TID: 484 Thread sleep time: -40297s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe TID: 1836 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\systray.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00409AB0 rdtsc 2_2_00409AB0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\52h0KETBXt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\systray.exe API coverage: 9.5 %
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Thread delayed: delay time: 40297 Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000011.00000003.832133080.00000000043CA000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000011.00000003.876255460.000000000E661000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}t
Source: explorer.exe, 00000011.00000003.863792121.000000000E65F000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}u
Source: explorer.exe, 00000011.00000003.838450298.00000000044A3000.00000004.00000001.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: 52h0KETBXt.exe, 00000001.00000002.682235184.0000000002994000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000011.00000003.876255460.000000000E661000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000000.845019433.00000000048EB000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATA.
Source: explorer.exe, 00000011.00000003.863792121.000000000E65F000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 00000011.00000003.876255460.000000000E661000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}j
Source: explorer.exe, 00000011.00000003.879250606.000000000E65F000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}k
Source: explorer.exe, 00000003.00000000.710637920.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000003.842103160.000000000445D000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B0
Source: explorer.exe, 00000011.00000003.863342536.00000000044BC000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000Exl
Source: explorer.exe, 00000003.00000000.721575599.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000003.00000000.727837702.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000011.00000003.844426612.000000000E3C7000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}21-3853321935-2125563209-40B2332-1002_Classes\Interface\{3f89d935-d9cb-4538-a0f0-ffe7659938f8}\ProxyStubClsid32
Source: explorer.exe, 00000003.00000000.727919641.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000011.00000003.869641661.0000000005DA7000.00000004.00000001.sdmp Binary or memory string: Prod_VMware_SATA[
Source: explorer.exe, 00000011.00000000.839276088.00000000043D3000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}efb8b}
Source: explorer.exe, 00000011.00000000.839741217.00000000044AB000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_
Source: explorer.exe, 00000011.00000003.839286095.0000000004385000.00000004.00000001.sdmp Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\8fb
Source: explorer.exe, 00000011.00000000.847178302.0000000005D8C000.00000004.00000001.sdmp Binary or memory string: 6e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA[
Source: 52h0KETBXt.exe, 00000001.00000002.682235184.0000000002994000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000011.00000003.832056182.00000000042FC000.00000004.00000001.sdmp Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000011.00000000.844218577.0000000004850000.00000004.00000001.sdmp Binary or memory string: Prod_VMware_SATA%
Source: explorer.exe, 00000011.00000000.839663386.000000000448B000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000011.00000003.839286095.0000000004385000.00000004.00000001.sdmp Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000003.861456572.000000000E65F000.00000004.00000001.sdmp Binary or memory string: \?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000003.841578981.0000000004385000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}}Y
Source: explorer.exe, 00000011.00000003.832056182.00000000042FC000.00000004.00000001.sdmp Binary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000011.00000000.839741217.00000000044AB000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_@HK
Source: explorer.exe, 00000011.00000000.845019433.00000000048EB000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000lZ
Source: explorer.exe, 00000011.00000000.837922098.00000000041E0000.00000004.00000001.sdmp Binary or memory string: \??\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}4
Source: 52h0KETBXt.exe, 00000001.00000002.682235184.0000000002994000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: explorer.exe, 00000011.00000003.842427446.00000000044A3000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}2
Source: explorer.exe, 00000011.00000000.839388539.00000000043E7000.00000004.00000001.sdmp Binary or memory string: NECVMWarVMware SATA CD001.00
Source: explorer.exe, 00000011.00000003.841578981.0000000004385000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}h
Source: explorer.exe, 00000011.00000003.842427446.00000000044A3000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}/
Source: explorer.exe, 00000011.00000003.839286095.0000000004385000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\
Source: explorer.exe, 00000011.00000003.851234330.000000000E3C2000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000011.00000003.865058659.000000000E613000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&
Source: explorer.exe, 00000011.00000003.842103160.000000000445D000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B_
Source: 52h0KETBXt.exe, 00000001.00000002.682235184.0000000002994000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000011.00000003.841578981.0000000004385000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000003.876255460.000000000E661000.00000004.00000001.sdmp Binary or memory string: \?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 00000003.00000000.689881285.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000011.00000000.846057040.0000000005C30000.00000004.00000001.sdmp Binary or memory string: _VMware_SATA_CD00#5&
Source: explorer.exe, 00000011.00000000.839550337.000000000441D000.00000004.00000001.sdmp Binary or memory string: 9Tm\Device\HarddiskVolume2\??\Volume{ef47ea26-ec76-4a6e-8680-9e53b539546d}\??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_00409AB0 rdtsc 2_2_00409AB0
Enables debug privileges
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A746D mov eax, dword ptr fs:[00000030h] 7_2_047A746D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BA44B mov eax, dword ptr fs:[00000030h] 7_2_047BA44B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04858CD6 mov eax, dword ptr fs:[00000030h] 7_2_04858CD6
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BBC2C mov eax, dword ptr fs:[00000030h] 7_2_047BBC2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806CF0 mov eax, dword ptr fs:[00000030h] 7_2_04806CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806CF0 mov eax, dword ptr fs:[00000030h] 7_2_04806CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806CF0 mov eax, dword ptr fs:[00000030h] 7_2_04806CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048414FB mov eax, dword ptr fs:[00000030h] 7_2_048414FB
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841C06 mov eax, dword ptr fs:[00000030h] 7_2_04841C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0485740D mov eax, dword ptr fs:[00000030h] 7_2_0485740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0485740D mov eax, dword ptr fs:[00000030h] 7_2_0485740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0485740D mov eax, dword ptr fs:[00000030h] 7_2_0485740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806C0A mov eax, dword ptr fs:[00000030h] 7_2_04806C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806C0A mov eax, dword ptr fs:[00000030h] 7_2_04806C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806C0A mov eax, dword ptr fs:[00000030h] 7_2_04806C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806C0A mov eax, dword ptr fs:[00000030h] 7_2_04806C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481C450 mov eax, dword ptr fs:[00000030h] 7_2_0481C450
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481C450 mov eax, dword ptr fs:[00000030h] 7_2_0481C450
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479849B mov eax, dword ptr fs:[00000030h] 7_2_0479849B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AC577 mov eax, dword ptr fs:[00000030h] 7_2_047AC577
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AC577 mov eax, dword ptr fs:[00000030h] 7_2_047AC577
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048505AC mov eax, dword ptr fs:[00000030h] 7_2_048505AC
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048505AC mov eax, dword ptr fs:[00000030h] 7_2_048505AC
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A7D50 mov eax, dword ptr fs:[00000030h] 7_2_047A7D50
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C3D43 mov eax, dword ptr fs:[00000030h] 7_2_047C3D43
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B4D3B mov eax, dword ptr fs:[00000030h] 7_2_047B4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B4D3B mov eax, dword ptr fs:[00000030h] 7_2_047B4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B4D3B mov eax, dword ptr fs:[00000030h] 7_2_047B4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478AD30 mov eax, dword ptr fs:[00000030h] 7_2_0478AD30
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806DC9 mov eax, dword ptr fs:[00000030h] 7_2_04806DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806DC9 mov eax, dword ptr fs:[00000030h] 7_2_04806DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806DC9 mov eax, dword ptr fs:[00000030h] 7_2_04806DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806DC9 mov ecx, dword ptr fs:[00000030h] 7_2_04806DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806DC9 mov eax, dword ptr fs:[00000030h] 7_2_04806DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04806DC9 mov eax, dword ptr fs:[00000030h] 7_2_04806DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04793D34 mov eax, dword ptr fs:[00000030h] 7_2_04793D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0484FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0484FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0484FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0484FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04838DF1 mov eax, dword ptr fs:[00000030h] 7_2_04838DF1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0479D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0479D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04858D34 mov eax, dword ptr fs:[00000030h] 7_2_04858D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0480A537 mov eax, dword ptr fs:[00000030h] 7_2_0480A537
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484E539 mov eax, dword ptr fs:[00000030h] 7_2_0484E539
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04803540 mov eax, dword ptr fs:[00000030h] 7_2_04803540
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B1DB5 mov eax, dword ptr fs:[00000030h] 7_2_047B1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B1DB5 mov eax, dword ptr fs:[00000030h] 7_2_047B1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B1DB5 mov eax, dword ptr fs:[00000030h] 7_2_047B1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B35A1 mov eax, dword ptr fs:[00000030h] 7_2_047B35A1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BFD9B mov eax, dword ptr fs:[00000030h] 7_2_047BFD9B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BFD9B mov eax, dword ptr fs:[00000030h] 7_2_047BFD9B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04782D8A mov eax, dword ptr fs:[00000030h] 7_2_04782D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04782D8A mov eax, dword ptr fs:[00000030h] 7_2_04782D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04782D8A mov eax, dword ptr fs:[00000030h] 7_2_04782D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04782D8A mov eax, dword ptr fs:[00000030h] 7_2_04782D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04782D8A mov eax, dword ptr fs:[00000030h] 7_2_04782D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2581 mov eax, dword ptr fs:[00000030h] 7_2_047B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2581 mov eax, dword ptr fs:[00000030h] 7_2_047B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2581 mov eax, dword ptr fs:[00000030h] 7_2_047B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2581 mov eax, dword ptr fs:[00000030h] 7_2_047B2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481FE87 mov eax, dword ptr fs:[00000030h] 7_2_0481FE87
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AAE73 mov eax, dword ptr fs:[00000030h] 7_2_047AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AAE73 mov eax, dword ptr fs:[00000030h] 7_2_047AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AAE73 mov eax, dword ptr fs:[00000030h] 7_2_047AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AAE73 mov eax, dword ptr fs:[00000030h] 7_2_047AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AAE73 mov eax, dword ptr fs:[00000030h] 7_2_047AAE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479766D mov eax, dword ptr fs:[00000030h] 7_2_0479766D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04850EA5 mov eax, dword ptr fs:[00000030h] 7_2_04850EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04850EA5 mov eax, dword ptr fs:[00000030h] 7_2_04850EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04850EA5 mov eax, dword ptr fs:[00000030h] 7_2_04850EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048046A7 mov eax, dword ptr fs:[00000030h] 7_2_048046A7
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04797E41 mov eax, dword ptr fs:[00000030h] 7_2_04797E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04797E41 mov eax, dword ptr fs:[00000030h] 7_2_04797E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04797E41 mov eax, dword ptr fs:[00000030h] 7_2_04797E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04797E41 mov eax, dword ptr fs:[00000030h] 7_2_04797E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04797E41 mov eax, dword ptr fs:[00000030h] 7_2_04797E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04797E41 mov eax, dword ptr fs:[00000030h] 7_2_04797E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0483FEC0 mov eax, dword ptr fs:[00000030h] 7_2_0483FEC0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04858ED6 mov eax, dword ptr fs:[00000030h] 7_2_04858ED6
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478E620 mov eax, dword ptr fs:[00000030h] 7_2_0478E620
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BA61C mov eax, dword ptr fs:[00000030h] 7_2_047BA61C
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BA61C mov eax, dword ptr fs:[00000030h] 7_2_047BA61C
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478C600 mov eax, dword ptr fs:[00000030h] 7_2_0478C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478C600 mov eax, dword ptr fs:[00000030h] 7_2_0478C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478C600 mov eax, dword ptr fs:[00000030h] 7_2_0478C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B8E00 mov eax, dword ptr fs:[00000030h] 7_2_047B8E00
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04841608 mov eax, dword ptr fs:[00000030h] 7_2_04841608
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B16E0 mov ecx, dword ptr fs:[00000030h] 7_2_047B16E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047976E2 mov eax, dword ptr fs:[00000030h] 7_2_047976E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B36CC mov eax, dword ptr fs:[00000030h] 7_2_047B36CC
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C8EC7 mov eax, dword ptr fs:[00000030h] 7_2_047C8EC7
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0483FE3F mov eax, dword ptr fs:[00000030h] 7_2_0483FE3F
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484AE44 mov eax, dword ptr fs:[00000030h] 7_2_0484AE44
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484AE44 mov eax, dword ptr fs:[00000030h] 7_2_0484AE44
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04807794 mov eax, dword ptr fs:[00000030h] 7_2_04807794
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04807794 mov eax, dword ptr fs:[00000030h] 7_2_04807794
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04807794 mov eax, dword ptr fs:[00000030h] 7_2_04807794
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479FF60 mov eax, dword ptr fs:[00000030h] 7_2_0479FF60
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479EF40 mov eax, dword ptr fs:[00000030h] 7_2_0479EF40
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BE730 mov eax, dword ptr fs:[00000030h] 7_2_047BE730
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04784F2E mov eax, dword ptr fs:[00000030h] 7_2_04784F2E
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04784F2E mov eax, dword ptr fs:[00000030h] 7_2_04784F2E
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AF716 mov eax, dword ptr fs:[00000030h] 7_2_047AF716
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BA70E mov eax, dword ptr fs:[00000030h] 7_2_047BA70E
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BA70E mov eax, dword ptr fs:[00000030h] 7_2_047BA70E
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0485070D mov eax, dword ptr fs:[00000030h] 7_2_0485070D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0485070D mov eax, dword ptr fs:[00000030h] 7_2_0485070D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C37F5 mov eax, dword ptr fs:[00000030h] 7_2_047C37F5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481FF10 mov eax, dword ptr fs:[00000030h] 7_2_0481FF10
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481FF10 mov eax, dword ptr fs:[00000030h] 7_2_0481FF10
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04798794 mov eax, dword ptr fs:[00000030h] 7_2_04798794
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04858F6A mov eax, dword ptr fs:[00000030h] 7_2_04858F6A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04803884 mov eax, dword ptr fs:[00000030h] 7_2_04803884
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04803884 mov eax, dword ptr fs:[00000030h] 7_2_04803884
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A0050 mov eax, dword ptr fs:[00000030h] 7_2_047A0050
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A0050 mov eax, dword ptr fs:[00000030h] 7_2_047A0050
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0481B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481B8D0 mov ecx, dword ptr fs:[00000030h] 7_2_0481B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0481B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0481B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0481B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0481B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0481B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479B02A mov eax, dword ptr fs:[00000030h] 7_2_0479B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479B02A mov eax, dword ptr fs:[00000030h] 7_2_0479B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479B02A mov eax, dword ptr fs:[00000030h] 7_2_0479B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479B02A mov eax, dword ptr fs:[00000030h] 7_2_0479B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B002D mov eax, dword ptr fs:[00000030h] 7_2_047B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B002D mov eax, dword ptr fs:[00000030h] 7_2_047B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B002D mov eax, dword ptr fs:[00000030h] 7_2_047B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B002D mov eax, dword ptr fs:[00000030h] 7_2_047B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B002D mov eax, dword ptr fs:[00000030h] 7_2_047B002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04854015 mov eax, dword ptr fs:[00000030h] 7_2_04854015
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04854015 mov eax, dword ptr fs:[00000030h] 7_2_04854015
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047858EC mov eax, dword ptr fs:[00000030h] 7_2_047858EC
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04807016 mov eax, dword ptr fs:[00000030h] 7_2_04807016
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04807016 mov eax, dword ptr fs:[00000030h] 7_2_04807016
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04807016 mov eax, dword ptr fs:[00000030h] 7_2_04807016
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047840E1 mov eax, dword ptr fs:[00000030h] 7_2_047840E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047840E1 mov eax, dword ptr fs:[00000030h] 7_2_047840E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047840E1 mov eax, dword ptr fs:[00000030h] 7_2_047840E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BF0BF mov ecx, dword ptr fs:[00000030h] 7_2_047BF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BF0BF mov eax, dword ptr fs:[00000030h] 7_2_047BF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BF0BF mov eax, dword ptr fs:[00000030h] 7_2_047BF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C90AF mov eax, dword ptr fs:[00000030h] 7_2_047C90AF
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B20A0 mov eax, dword ptr fs:[00000030h] 7_2_047B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B20A0 mov eax, dword ptr fs:[00000030h] 7_2_047B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B20A0 mov eax, dword ptr fs:[00000030h] 7_2_047B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B20A0 mov eax, dword ptr fs:[00000030h] 7_2_047B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B20A0 mov eax, dword ptr fs:[00000030h] 7_2_047B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B20A0 mov eax, dword ptr fs:[00000030h] 7_2_047B20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04851074 mov eax, dword ptr fs:[00000030h] 7_2_04851074
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04842073 mov eax, dword ptr fs:[00000030h] 7_2_04842073
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04789080 mov eax, dword ptr fs:[00000030h] 7_2_04789080
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478B171 mov eax, dword ptr fs:[00000030h] 7_2_0478B171
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478B171 mov eax, dword ptr fs:[00000030h] 7_2_0478B171
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478C962 mov eax, dword ptr fs:[00000030h] 7_2_0478C962
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048069A6 mov eax, dword ptr fs:[00000030h] 7_2_048069A6
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AB944 mov eax, dword ptr fs:[00000030h] 7_2_047AB944
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AB944 mov eax, dword ptr fs:[00000030h] 7_2_047AB944
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048051BE mov eax, dword ptr fs:[00000030h] 7_2_048051BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048051BE mov eax, dword ptr fs:[00000030h] 7_2_048051BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048051BE mov eax, dword ptr fs:[00000030h] 7_2_048051BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048051BE mov eax, dword ptr fs:[00000030h] 7_2_048051BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B513A mov eax, dword ptr fs:[00000030h] 7_2_047B513A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B513A mov eax, dword ptr fs:[00000030h] 7_2_047B513A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A4120 mov eax, dword ptr fs:[00000030h] 7_2_047A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A4120 mov eax, dword ptr fs:[00000030h] 7_2_047A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A4120 mov eax, dword ptr fs:[00000030h] 7_2_047A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A4120 mov eax, dword ptr fs:[00000030h] 7_2_047A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A4120 mov ecx, dword ptr fs:[00000030h] 7_2_047A4120
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048141E8 mov eax, dword ptr fs:[00000030h] 7_2_048141E8
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04789100 mov eax, dword ptr fs:[00000030h] 7_2_04789100
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04789100 mov eax, dword ptr fs:[00000030h] 7_2_04789100
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04789100 mov eax, dword ptr fs:[00000030h] 7_2_04789100
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0478B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0478B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0478B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B61A0 mov eax, dword ptr fs:[00000030h] 7_2_047B61A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B61A0 mov eax, dword ptr fs:[00000030h] 7_2_047B61A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2990 mov eax, dword ptr fs:[00000030h] 7_2_047B2990
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047AC182 mov eax, dword ptr fs:[00000030h] 7_2_047AC182
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BA185 mov eax, dword ptr fs:[00000030h] 7_2_047BA185
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C927A mov eax, dword ptr fs:[00000030h] 7_2_047C927A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04789240 mov eax, dword ptr fs:[00000030h] 7_2_04789240
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04789240 mov eax, dword ptr fs:[00000030h] 7_2_04789240
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04789240 mov eax, dword ptr fs:[00000030h] 7_2_04789240
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04789240 mov eax, dword ptr fs:[00000030h] 7_2_04789240
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C4A2C mov eax, dword ptr fs:[00000030h] 7_2_047C4A2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047C4A2C mov eax, dword ptr fs:[00000030h] 7_2_047C4A2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047A3A1C mov eax, dword ptr fs:[00000030h] 7_2_047A3A1C
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04785210 mov eax, dword ptr fs:[00000030h] 7_2_04785210
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04785210 mov ecx, dword ptr fs:[00000030h] 7_2_04785210
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04785210 mov eax, dword ptr fs:[00000030h] 7_2_04785210
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04785210 mov eax, dword ptr fs:[00000030h] 7_2_04785210
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478AA16 mov eax, dword ptr fs:[00000030h] 7_2_0478AA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478AA16 mov eax, dword ptr fs:[00000030h] 7_2_0478AA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04798A0A mov eax, dword ptr fs:[00000030h] 7_2_04798A0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484AA16 mov eax, dword ptr fs:[00000030h] 7_2_0484AA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484AA16 mov eax, dword ptr fs:[00000030h] 7_2_0484AA16
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2AE4 mov eax, dword ptr fs:[00000030h] 7_2_047B2AE4
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2ACB mov eax, dword ptr fs:[00000030h] 7_2_047B2ACB
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0479AAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0479AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0479AAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BFAB0 mov eax, dword ptr fs:[00000030h] 7_2_047BFAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484EA55 mov eax, dword ptr fs:[00000030h] 7_2_0484EA55
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04814257 mov eax, dword ptr fs:[00000030h] 7_2_04814257
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047852A5 mov eax, dword ptr fs:[00000030h] 7_2_047852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047852A5 mov eax, dword ptr fs:[00000030h] 7_2_047852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047852A5 mov eax, dword ptr fs:[00000030h] 7_2_047852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047852A5 mov eax, dword ptr fs:[00000030h] 7_2_047852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047852A5 mov eax, dword ptr fs:[00000030h] 7_2_047852A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0483B260 mov eax, dword ptr fs:[00000030h] 7_2_0483B260
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0483B260 mov eax, dword ptr fs:[00000030h] 7_2_0483B260
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04858A62 mov eax, dword ptr fs:[00000030h] 7_2_04858A62
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BD294 mov eax, dword ptr fs:[00000030h] 7_2_047BD294
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BD294 mov eax, dword ptr fs:[00000030h] 7_2_047BD294
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B3B7A mov eax, dword ptr fs:[00000030h] 7_2_047B3B7A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B3B7A mov eax, dword ptr fs:[00000030h] 7_2_047B3B7A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0483D380 mov ecx, dword ptr fs:[00000030h] 7_2_0483D380
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484138A mov eax, dword ptr fs:[00000030h] 7_2_0484138A
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478DB60 mov ecx, dword ptr fs:[00000030h] 7_2_0478DB60
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04855BA5 mov eax, dword ptr fs:[00000030h] 7_2_04855BA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478F358 mov eax, dword ptr fs:[00000030h] 7_2_0478F358
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0478DB40 mov eax, dword ptr fs:[00000030h] 7_2_0478DB40
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048053CA mov eax, dword ptr fs:[00000030h] 7_2_048053CA
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_048053CA mov eax, dword ptr fs:[00000030h] 7_2_048053CA
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047ADBE9 mov eax, dword ptr fs:[00000030h] 7_2_047ADBE9
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B03E2 mov eax, dword ptr fs:[00000030h] 7_2_047B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B03E2 mov eax, dword ptr fs:[00000030h] 7_2_047B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B03E2 mov eax, dword ptr fs:[00000030h] 7_2_047B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B03E2 mov eax, dword ptr fs:[00000030h] 7_2_047B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B03E2 mov eax, dword ptr fs:[00000030h] 7_2_047B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B03E2 mov eax, dword ptr fs:[00000030h] 7_2_047B03E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_0484131B mov eax, dword ptr fs:[00000030h] 7_2_0484131B
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B4BAD mov eax, dword ptr fs:[00000030h] 7_2_047B4BAD
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B4BAD mov eax, dword ptr fs:[00000030h] 7_2_047B4BAD
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B4BAD mov eax, dword ptr fs:[00000030h] 7_2_047B4BAD
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04858B58 mov eax, dword ptr fs:[00000030h] 7_2_04858B58
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047BB390 mov eax, dword ptr fs:[00000030h] 7_2_047BB390
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_047B2397 mov eax, dword ptr fs:[00000030h] 7_2_047B2397
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04791B8F mov eax, dword ptr fs:[00000030h] 7_2_04791B8F
Source: C:\Windows\SysWOW64\systray.exe Code function: 7_2_04791B8F mov eax, dword ptr fs:[00000030h] 7_2_04791B8F
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\52h0KETBXt.exe Code function: 2_2_0040ACF0 LdrLoadDll, 2_2_0040ACF0
Source: C:\Users\user\Desktop\52h0KETBXt.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\52h0KETBXt.exe Section unmapped: C:\Windows\SysWOW64\systray.exe base address: 2F0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\52h0KETBXt.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\52h0KETBXt.exe Memory written: C:\Users\user\Desktop\52h0KETBXt.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\52h0KETBXt.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\52h0KETBXt.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Thread register set: target process: 5104 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\52h0KETBXt.exe Process created: C:\Users\user\Desktop\52h0KETBXt.exe C:\Users\user\Desktop\52h0KETBXt.exe Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\52h0KETBXt.exe" Jump to behavior
Source: explorer.exe, 00000003.00000000.703139541.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000003.00000000.720088313.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000003.00000000.683371877.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000003.00000000.720434938.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.684416407.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.703475990.0000000001080000.00000002.00020000.sdmp, systray.exe, 00000007.00000002.933346095.0000000002F90000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000000.720434938.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.684416407.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.723576083.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.703475990.0000000001080000.00000002.00020000.sdmp, systray.exe, 00000007.00000002.933346095.0000000002F90000.00000002.00020000.sdmp, explorer.exe, 00000011.00000000.834942485.0000000000EB0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.720434938.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.684416407.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.703475990.0000000001080000.00000002.00020000.sdmp, systray.exe, 00000007.00000002.933346095.0000000002F90000.00000002.00020000.sdmp, explorer.exe, 00000011.00000000.834942485.0000000000EB0000.00000002.00020000.sdmp, explorer.exe, 00000011.00000000.846018705.00000000053B0000.00000004.00000001.sdmp, explorer.exe, 00000011.00000000.834267617.00000000008F7000.00000004.00000020.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000011.00000000.834942485.0000000000EB0000.00000002.00020000.sdmp Binary or memory string: Program Manager{g
Source: explorer.exe, 00000003.00000000.720434938.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.684416407.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000003.00000000.703475990.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000011.00000000.834942485.0000000000EB0000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000011.00000000.844218577.0000000004850000.00000004.00000001.sdmp Binary or memory string: Progmanng
Source: explorer.exe, 00000003.00000000.710811898.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.695510417.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000003.00000000.727837702.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Users\user\Desktop\52h0KETBXt.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\52h0KETBXt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.52h0KETBXt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.52h0KETBXt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.929865713.0000000000470000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.740647599.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.741087450.0000000000A30000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.713850034.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.679919351.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.741186169.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.729857444.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.932677156.0000000002840000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.932951022.0000000002940000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.52h0KETBXt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.52h0KETBXt.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.52h0KETBXt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000000.679463516.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.929865713.0000000000470000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.740647599.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.741087450.0000000000A30000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.713850034.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.679919351.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.741186169.0000000000E60000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.729857444.000000000DAB7000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.932677156.0000000002840000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.932951022.0000000002940000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.682477718.00000000038F9000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 552749 Sample: 52h0KETBXt.exe Startdate: 13/01/2022 Architecture: WINDOWS Score: 100 37 Multi AV Scanner detection for domain / URL 2->37 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 8 other signatures 2->43 10 52h0KETBXt.exe 3 2->10         started        process3 file4 33 C:\Users\user\AppData\...\52h0KETBXt.exe.log, ASCII 10->33 dropped 53 Tries to detect virtualization through RDTSC time measurements 10->53 55 Injects a PE file into a foreign processes 10->55 14 52h0KETBXt.exe 10->14         started        signatures5 process6 signatures7 57 Modifies the context of a thread in another process (thread injection) 14->57 59 Maps a DLL or memory area into another process 14->59 61 Sample uses process hollowing technique 14->61 63 Queues an APC in another process (thread injection) 14->63 17 explorer.exe 14->17 injected process8 process9 19 systray.exe 17->19         started        22 autofmt.exe 17->22         started        24 autoconv.exe 17->24         started        signatures10 45 Self deletion via cmd delete 19->45 47 Modifies the context of a thread in another process (thread injection) 19->47 49 Maps a DLL or memory area into another process 19->49 51 Tries to detect virtualization through RDTSC time measurements 19->51 26 explorer.exe 1 154 19->26         started        29 cmd.exe 1 19->29         started        process11 dnsIp12 35 192.168.2.1 unknown unknown 26->35 31 conhost.exe 29->31         started        process13
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious

Private
IP
192.168.2.1

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.hstolchsjybyl.com/a83r/ true
  • 5%, Virustotal, Browse
  • Avira URL Cloud: safe
 low