Windows Analysis Report SecuriteInfo.com.Variant.Bulz.785643.17886.29229

Overview

General Information

Sample Name: SecuriteInfo.com.Variant.Bulz.785643.17886.29229 (renamed file extension from 29229 to exe)
Analysis ID: 552971
MD5: 83ac585e99b527eeb278702f8f711568
SHA1: a576a927b067c94cdbc1e7b353f60577f5b310f9
SHA256: 9e2502b3945f31482623e8e61dcb85b9ebb7d9a4244d9074fa289596c9da513e
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
.NET source code contains potential unpacker
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.topeasyip.company/i5nb/"], "decoy": ["integratedheartspsychology.com", "tappsis.land", "norfg.com", "1531700.win", "oneplusoneexperience.com", "circlessalaries.com", "tlcremodelingcompany.com", "susalud.info", "liyanghua.club", "pink-zemi.com", "orphe.biz", "themodelclarified.com", "candidate.tools", "morotrip.com", "d2dfms.com", "leisuresabah.com", "bjbwx114.com", "lz-fcaini1718-hw0917-bs.xyz", "at-commerce-co.net", "buymypolicy.net", "5151vip73.com", "rentglide.com", "louiecruzbeltran.info", "lanabasargina.com", "lakeforestparkapartments.com", "guangkaiyinwu.com", "bornthin.com", "restaurantkitchenbuilders.com", "ecommerceoptimise.com", "datahk99.com", "markfwalker.com", "granitowawarszawa.com", "theyouthwave.com", "iabg.xyz", "jholbrook.com", "bsc.promo", "xn--grlitzerseebhne-8sb7i.com", "cafeteriasula.com", "plushcrispies.com", "dedicatedvirtualassistance.com", "ventura-taxi.com", "thoethertb434-ocn.xyz", "ylhwcl.com", "bigsyncmusic.biz", "terapiaholisticaemformacao.com", "comidies.com", "171diproad.com", "07dgj.xyz", "vppaintllc.com", "thepatriottutor.com", "wxfive.com", "ceinpsico.com", "tuningelement.store", "asinment.com", "diafraz.xyz", "8crhnwh658ga.biz", "redwolf-tech.com", "ksherfan.com", "sensationalshroom.com", "buy-instagram-followers.net", "treeserviceconsulting.com", "vnln.space", "kate-films.com", "selfmeta.club"]}
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Virustotal: Detection: 43% Perma Link
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe ReversingLabs: Detection: 43%
Yara detected FormBook
Source: Yara match File source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.45332e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.44dc2c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.302341566.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.300583047.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp, type: MEMORY
Antivirus / Scanner detection for submitted sample
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Avira: detected
Antivirus detection for URL or domain
Source: www.topeasyip.company/i5nb/ Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302747431.0000000001A9F000.00000040.00000001.sdmp, SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302556621.0000000001980000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302747431.0000000001A9F000.00000040.00000001.sdmp, SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302556621.0000000001980000.00000040.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 4x nop then pop esi 12_2_0041584D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 4x nop then pop edi 12_2_004162F6

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.topeasyip.company/i5nb/
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.305823260.00000000073E2000.00000004.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302319122.00000000014EB000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.45332e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.44dc2c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.302341566.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.300583047.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.45332e0.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.45332e0.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.44dc2c0.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.44dc2c0.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.302341566.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.302341566.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000000.300583047.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000000.300583047.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.45332e0.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.45332e0.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.44dc2c0.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.44dc2c0.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.302341566.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.302341566.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000000.300583047.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000000.300583047.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 0_2_014D8122 0_2_014D8122
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 0_2_014D6A08 0_2_014D6A08
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 0_2_014D6D2E 0_2_014D6D2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 0_2_014D7E10 0_2_014D7E10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 0_2_014D6D72 0_2_014D6D72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 0_2_014D7271 0_2_014D7271
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00401030 12_2_00401030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041C95A 12_2_0041C95A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041C96E 12_2_0041C96E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041D128 12_2_0041D128
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041C38D 12_2_0041C38D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041BB9E 12_2_0041BB9E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00408C90 12_2_00408C90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00402D8A 12_2_00402D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00402D90 12_2_00402D90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041BF8B 12_2_0041BF8B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00402FB0 12_2_00402FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BC1C0 12_2_019BC1C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4120 12_2_019C4120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB090 12_2_019BB090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A720A8 12_2_01A720A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D20A0 12_2_019D20A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A660F5 12_2_01A660F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D701D 12_2_019D701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A61002 12_2_01A61002
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D138B 12_2_019D138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A523E3 12_2_01A523E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A603DA 12_2_01A603DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6231B 12_2_01A6231B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C3360 12_2_019C3360
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A722AE 12_2_01A722AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A732A9 12_2_01A732A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AC2C3 12_2_019AC2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6E2C5 12_2_01A6E2C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB236 12_2_019CB236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D2581 12_2_019D2581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D65A0 12_2_019D65A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A725DD 12_2_01A725DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BD5E0 12_2_019BD5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B841F 12_2_019B841F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C2430 12_2_019C2430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6D466 12_2_01A6D466
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A667E2 12_2_01A667E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6D616 12_2_01A6D616
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9660 12_2_019A9660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C2990 12_2_019C2990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B1915 12_2_019B1915
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AF900 12_2_019AF900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A728EC 12_2_01A728EC
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: String function: 019AB150 appears 103 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: String function: 01A35720 appears 65 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: String function: 019FD08C appears 32 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_004185F0 NtCreateFile, 12_2_004185F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_004186A0 NtReadFile, 12_2_004186A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00418720 NtClose, 12_2_00418720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_004187D0 NtAllocateVirtualMemory, 12_2_004187D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00418642 NtCreateFile, 12_2_00418642
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041869D NtReadFile, 12_2_0041869D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041871A NtClose, 12_2_0041871A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_004187CB NtAllocateVirtualMemory, 12_2_004187CB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E96E0 NtFreeVirtualMemory,LdrInitializeThunk, 12_2_019E96E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9660 NtAllocateVirtualMemory,LdrInitializeThunk, 12_2_019E9660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9860 NtQuerySystemInformation,LdrInitializeThunk, 12_2_019E9860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019EB040 NtSuspendThread, 12_2_019EB040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019EA3B0 NtGetContextThread, 12_2_019EA3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E95D0 NtClose, 12_2_019E95D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E95F0 NtQueryInformationFile, 12_2_019E95F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9520 NtWaitForSingleObject, 12_2_019E9520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9540 NtReadFile, 12_2_019E9540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9560 NtWriteFile, 12_2_019E9560
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9780 NtMapViewOfSection, 12_2_019E9780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E97A0 NtUnmapViewOfSection, 12_2_019E97A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9710 NtQueryInformationToken, 12_2_019E9710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019EA710 NtOpenProcessToken, 12_2_019EA710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9730 NtQueryVirtualMemory, 12_2_019E9730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019EA770 NtOpenThread, 12_2_019EA770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9770 NtSetInformationFile, 12_2_019E9770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9760 NtOpenProcess, 12_2_019E9760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E96D0 NtCreateKey, 12_2_019E96D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9610 NtEnumerateValueKey, 12_2_019E9610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9650 NtQueryValueKey, 12_2_019E9650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9670 NtQueryInformationProcess, 12_2_019E9670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E99A0 NtCreateSection, 12_2_019E99A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E99D0 NtCreateProcessEx, 12_2_019E99D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9910 NtAdjustPrivilegesToken, 12_2_019E9910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E9950 NtQueueApcThread, 12_2_019E9950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E98A0 NtWriteVirtualMemory, 12_2_019E98A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E98F0 NtReadVirtualMemory, 12_2_019E98F0
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302319122.00000000014EB000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000000.278924225.0000000000D62000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamegetDeviceClaimsd.exe8 vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.306336909.0000000007930000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Binary or memory string: OriginalFilename vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302747431.0000000001A9F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000000.298139804.0000000000F92000.00000002.00020000.sdmp Binary or memory string: OriginalFilenamegetDeviceClaimsd.exe8 vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.303018064.0000000001C2F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Binary or memory string: OriginalFilenamegetDeviceClaimsd.exe8 vs SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Virustotal: Detection: 43%
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe ReversingLabs: Detection: 43%
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe "C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Variant.Bulz.785643.17886.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@3/1@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302747431.0000000001A9F000.00000040.00000001.sdmp, SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302556621.0000000001980000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302747431.0000000001A9F000.00000040.00000001.sdmp, SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 0000000C.00000002.302556621.0000000001980000.00000040.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.d60000.0.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.d60000.0.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.f90000.3.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.f90000.1.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.f90000.2.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.f90000.0.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.f90000.7.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.f90000.9.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.f90000.1.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.f90000.5.unpack, u0005u2000.cs .Net Code: \x02 System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 0_2_00D6E0EF push esp; iretd 0_2_00D6E0F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041B842 push eax; ret 12_2_0041B848
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041B84B push eax; ret 12_2_0041B8B2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_004188F2 push ds; ret 12_2_004188F3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041B8AC push eax; ret 12_2_0041B8B2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00416109 push cs; iretd 12_2_0041610A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00415237 pushfd ; iretd 12_2_00415238
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_0041B7F5 push eax; ret 12_2_0041B848
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_00F9E0EF push esp; iretd 12_2_00F9E0F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019FD0D1 push ecx; ret 12_2_019FD0E4
Source: initial sample Static PE information: section name: .text entropy: 7.74258433139
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.33c02a4.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.340c584.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.302962488.00000000033D3000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.302905715.0000000003391000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Variant.Bulz.785643.17886.exe PID: 7128, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302962488.00000000033D3000.00000004.00000001.sdmp, SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302905715.0000000003391000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302962488.00000000033D3000.00000004.00000001.sdmp, SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302905715.0000000003391000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe TID: 7132 Thread sleep time: -37702s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe TID: 4784 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_004088E0 rdtsc 12_2_004088E0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe API coverage: 1.8 %
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Thread delayed: delay time: 37702 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302905715.0000000003391000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302905715.0000000003391000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302905715.0000000003391000.00000004.00000001.sdmp Binary or memory string: vmware
Source: SecuriteInfo.com.Variant.Bulz.785643.17886.exe, 00000000.00000002.302905715.0000000003391000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_004088E0 rdtsc 12_2_004088E0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A519E mov eax, dword ptr fs:[00000030h] 12_2_019A519E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A519E mov ecx, dword ptr fs:[00000030h] 12_2_019A519E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8190 mov ecx, dword ptr fs:[00000030h] 12_2_019A8190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D4190 mov eax, dword ptr fs:[00000030h] 12_2_019D4190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A7F1B5 mov eax, dword ptr fs:[00000030h] 12_2_01A7F1B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A7F1B5 mov eax, dword ptr fs:[00000030h] 12_2_01A7F1B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DA185 mov eax, dword ptr fs:[00000030h] 12_2_019DA185
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A251BE mov eax, dword ptr fs:[00000030h] 12_2_01A251BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A251BE mov eax, dword ptr fs:[00000030h] 12_2_01A251BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A251BE mov eax, dword ptr fs:[00000030h] 12_2_01A251BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A251BE mov eax, dword ptr fs:[00000030h] 12_2_01A251BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CC182 mov eax, dword ptr fs:[00000030h] 12_2_019CC182
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6A189 mov eax, dword ptr fs:[00000030h] 12_2_01A6A189
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6A189 mov ecx, dword ptr fs:[00000030h] 12_2_01A6A189
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B61A7 mov eax, dword ptr fs:[00000030h] 12_2_019B61A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B61A7 mov eax, dword ptr fs:[00000030h] 12_2_019B61A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B61A7 mov eax, dword ptr fs:[00000030h] 12_2_019B61A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B61A7 mov eax, dword ptr fs:[00000030h] 12_2_019B61A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D61A0 mov eax, dword ptr fs:[00000030h] 12_2_019D61A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D61A0 mov eax, dword ptr fs:[00000030h] 12_2_019D61A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A341E8 mov eax, dword ptr fs:[00000030h] 12_2_01A341E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A3D1F9 mov eax, dword ptr fs:[00000030h] 12_2_01A3D1F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BC1C0 mov eax, dword ptr fs:[00000030h] 12_2_019BC1C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CD1EF mov eax, dword ptr fs:[00000030h] 12_2_019CD1EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov ecx, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov ecx, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A631DC mov eax, dword ptr fs:[00000030h] 12_2_01A631DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A31E0 mov eax, dword ptr fs:[00000030h] 12_2_019A31E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB1E1 mov eax, dword ptr fs:[00000030h] 12_2_019AB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB1E1 mov eax, dword ptr fs:[00000030h] 12_2_019AB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB1E1 mov eax, dword ptr fs:[00000030h] 12_2_019AB1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9100 mov eax, dword ptr fs:[00000030h] 12_2_019A9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9100 mov eax, dword ptr fs:[00000030h] 12_2_019A9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9100 mov eax, dword ptr fs:[00000030h] 12_2_019A9100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B0100 mov eax, dword ptr fs:[00000030h] 12_2_019B0100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B0100 mov eax, dword ptr fs:[00000030h] 12_2_019B0100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B0100 mov eax, dword ptr fs:[00000030h] 12_2_019B0100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A3138 mov ecx, dword ptr fs:[00000030h] 12_2_019A3138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D513A mov eax, dword ptr fs:[00000030h] 12_2_019D513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D513A mov eax, dword ptr fs:[00000030h] 12_2_019D513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4120 mov eax, dword ptr fs:[00000030h] 12_2_019C4120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4120 mov eax, dword ptr fs:[00000030h] 12_2_019C4120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4120 mov eax, dword ptr fs:[00000030h] 12_2_019C4120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4120 mov eax, dword ptr fs:[00000030h] 12_2_019C4120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4120 mov ecx, dword ptr fs:[00000030h] 12_2_019C4120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB171 mov eax, dword ptr fs:[00000030h] 12_2_019AB171
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB171 mov eax, dword ptr fs:[00000030h] 12_2_019AB171
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A2714D mov eax, dword ptr fs:[00000030h] 12_2_01A2714D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A2714D mov eax, dword ptr fs:[00000030h] 12_2_01A2714D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9080 mov eax, dword ptr fs:[00000030h] 12_2_019A9080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB080 mov eax, dword ptr fs:[00000030h] 12_2_019AB080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DF0BF mov ecx, dword ptr fs:[00000030h] 12_2_019DF0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DF0BF mov eax, dword ptr fs:[00000030h] 12_2_019DF0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DF0BF mov eax, dword ptr fs:[00000030h] 12_2_019DF0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E90AF mov eax, dword ptr fs:[00000030h] 12_2_019E90AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D20A0 mov eax, dword ptr fs:[00000030h] 12_2_019D20A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D20A0 mov eax, dword ptr fs:[00000030h] 12_2_019D20A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D20A0 mov eax, dword ptr fs:[00000030h] 12_2_019D20A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D20A0 mov eax, dword ptr fs:[00000030h] 12_2_019D20A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D20A0 mov eax, dword ptr fs:[00000030h] 12_2_019D20A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D20A0 mov eax, dword ptr fs:[00000030h] 12_2_019D20A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A660F5 mov eax, dword ptr fs:[00000030h] 12_2_01A660F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A660F5 mov eax, dword ptr fs:[00000030h] 12_2_01A660F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A660F5 mov eax, dword ptr fs:[00000030h] 12_2_01A660F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A660F5 mov eax, dword ptr fs:[00000030h] 12_2_01A660F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A70C0 mov eax, dword ptr fs:[00000030h] 12_2_019A70C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A70C0 mov eax, dword ptr fs:[00000030h] 12_2_019A70C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B0C7 mov eax, dword ptr fs:[00000030h] 12_2_01A6B0C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B0C7 mov eax, dword ptr fs:[00000030h] 12_2_01A6B0C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A40E1 mov eax, dword ptr fs:[00000030h] 12_2_019A40E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A40E1 mov eax, dword ptr fs:[00000030h] 12_2_019A40E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A40E1 mov eax, dword ptr fs:[00000030h] 12_2_019A40E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D701D mov eax, dword ptr fs:[00000030h] 12_2_019D701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D701D mov eax, dword ptr fs:[00000030h] 12_2_019D701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D701D mov eax, dword ptr fs:[00000030h] 12_2_019D701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D701D mov eax, dword ptr fs:[00000030h] 12_2_019D701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D701D mov eax, dword ptr fs:[00000030h] 12_2_019D701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D701D mov eax, dword ptr fs:[00000030h] 12_2_019D701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D002D mov eax, dword ptr fs:[00000030h] 12_2_019D002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D002D mov eax, dword ptr fs:[00000030h] 12_2_019D002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D002D mov eax, dword ptr fs:[00000030h] 12_2_019D002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D002D mov eax, dword ptr fs:[00000030h] 12_2_019D002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D002D mov eax, dword ptr fs:[00000030h] 12_2_019D002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB02A mov eax, dword ptr fs:[00000030h] 12_2_019BB02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB02A mov eax, dword ptr fs:[00000030h] 12_2_019BB02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB02A mov eax, dword ptr fs:[00000030h] 12_2_019BB02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB02A mov eax, dword ptr fs:[00000030h] 12_2_019BB02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A74015 mov eax, dword ptr fs:[00000030h] 12_2_01A74015
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A74015 mov eax, dword ptr fs:[00000030h] 12_2_01A74015
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A27016 mov eax, dword ptr fs:[00000030h] 12_2_01A27016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A27016 mov eax, dword ptr fs:[00000030h] 12_2_01A27016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A27016 mov eax, dword ptr fs:[00000030h] 12_2_01A27016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A33019 mov eax, dword ptr fs:[00000030h] 12_2_01A33019
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D4020 mov edi, dword ptr fs:[00000030h] 12_2_019D4020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A5050 mov eax, dword ptr fs:[00000030h] 12_2_019A5050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A5050 mov eax, dword ptr fs:[00000030h] 12_2_019A5050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A5050 mov eax, dword ptr fs:[00000030h] 12_2_019A5050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C0050 mov eax, dword ptr fs:[00000030h] 12_2_019C0050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C0050 mov eax, dword ptr fs:[00000030h] 12_2_019C0050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A7057 mov eax, dword ptr fs:[00000030h] 12_2_019A7057
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A71074 mov eax, dword ptr fs:[00000030h] 12_2_01A71074
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A62073 mov eax, dword ptr fs:[00000030h] 12_2_01A62073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D2397 mov eax, dword ptr fs:[00000030h] 12_2_019D2397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DB390 mov eax, dword ptr fs:[00000030h] 12_2_019DB390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D138B mov eax, dword ptr fs:[00000030h] 12_2_019D138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D138B mov eax, dword ptr fs:[00000030h] 12_2_019D138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D138B mov eax, dword ptr fs:[00000030h] 12_2_019D138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A5D380 mov ecx, dword ptr fs:[00000030h] 12_2_01A5D380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6138A mov eax, dword ptr fs:[00000030h] 12_2_01A6138A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A523E3 mov ecx, dword ptr fs:[00000030h] 12_2_01A523E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A523E3 mov ecx, dword ptr fs:[00000030h] 12_2_01A523E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A523E3 mov eax, dword ptr fs:[00000030h] 12_2_01A523E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D53C5 mov eax, dword ptr fs:[00000030h] 12_2_019D53C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A253CA mov eax, dword ptr fs:[00000030h] 12_2_01A253CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A253CA mov eax, dword ptr fs:[00000030h] 12_2_01A253CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D03E2 mov eax, dword ptr fs:[00000030h] 12_2_019D03E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D03E2 mov eax, dword ptr fs:[00000030h] 12_2_019D03E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D03E2 mov eax, dword ptr fs:[00000030h] 12_2_019D03E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D03E2 mov eax, dword ptr fs:[00000030h] 12_2_019D03E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D03E2 mov eax, dword ptr fs:[00000030h] 12_2_019D03E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D03E2 mov eax, dword ptr fs:[00000030h] 12_2_019D03E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA309 mov eax, dword ptr fs:[00000030h] 12_2_019CA309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6131B mov eax, dword ptr fs:[00000030h] 12_2_01A6131B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AF358 mov eax, dword ptr fs:[00000030h] 12_2_019AF358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A36365 mov eax, dword ptr fs:[00000030h] 12_2_01A36365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A36365 mov eax, dword ptr fs:[00000030h] 12_2_01A36365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A36365 mov eax, dword ptr fs:[00000030h] 12_2_01A36365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BF370 mov eax, dword ptr fs:[00000030h] 12_2_019BF370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BF370 mov eax, dword ptr fs:[00000030h] 12_2_019BF370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BF370 mov eax, dword ptr fs:[00000030h] 12_2_019BF370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DD294 mov eax, dword ptr fs:[00000030h] 12_2_019DD294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DD294 mov eax, dword ptr fs:[00000030h] 12_2_019DD294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D12BD mov esi, dword ptr fs:[00000030h] 12_2_019D12BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D12BD mov eax, dword ptr fs:[00000030h] 12_2_019D12BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D12BD mov eax, dword ptr fs:[00000030h] 12_2_019D12BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B62A0 mov eax, dword ptr fs:[00000030h] 12_2_019B62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B62A0 mov eax, dword ptr fs:[00000030h] 12_2_019B62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B62A0 mov eax, dword ptr fs:[00000030h] 12_2_019B62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B62A0 mov eax, dword ptr fs:[00000030h] 12_2_019B62A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6129A mov eax, dword ptr fs:[00000030h] 12_2_01A6129A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A52A5 mov eax, dword ptr fs:[00000030h] 12_2_019A52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A52A5 mov eax, dword ptr fs:[00000030h] 12_2_019A52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A52A5 mov eax, dword ptr fs:[00000030h] 12_2_019A52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A52A5 mov eax, dword ptr fs:[00000030h] 12_2_019A52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A52A5 mov eax, dword ptr fs:[00000030h] 12_2_019A52A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A12D4 mov eax, dword ptr fs:[00000030h] 12_2_019A12D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B2E8 mov eax, dword ptr fs:[00000030h] 12_2_01A6B2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B2E8 mov eax, dword ptr fs:[00000030h] 12_2_01A6B2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B2E8 mov eax, dword ptr fs:[00000030h] 12_2_01A6B2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B2E8 mov eax, dword ptr fs:[00000030h] 12_2_01A6B2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A5210 mov eax, dword ptr fs:[00000030h] 12_2_019A5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A5210 mov ecx, dword ptr fs:[00000030h] 12_2_019A5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A5210 mov eax, dword ptr fs:[00000030h] 12_2_019A5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A5210 mov eax, dword ptr fs:[00000030h] 12_2_019A5210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A61229 mov eax, dword ptr fs:[00000030h] 12_2_01A61229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8239 mov eax, dword ptr fs:[00000030h] 12_2_019A8239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8239 mov eax, dword ptr fs:[00000030h] 12_2_019A8239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8239 mov eax, dword ptr fs:[00000030h] 12_2_019A8239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB233 mov eax, dword ptr fs:[00000030h] 12_2_019AB233
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB233 mov eax, dword ptr fs:[00000030h] 12_2_019AB233
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB236 mov eax, dword ptr fs:[00000030h] 12_2_019CB236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB236 mov eax, dword ptr fs:[00000030h] 12_2_019CB236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB236 mov eax, dword ptr fs:[00000030h] 12_2_019CB236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB236 mov eax, dword ptr fs:[00000030h] 12_2_019CB236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB236 mov eax, dword ptr fs:[00000030h] 12_2_019CB236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB236 mov eax, dword ptr fs:[00000030h] 12_2_019CB236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CA229 mov eax, dword ptr fs:[00000030h] 12_2_019CA229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A5B260 mov eax, dword ptr fs:[00000030h] 12_2_01A5B260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A5B260 mov eax, dword ptr fs:[00000030h] 12_2_01A5B260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9240 mov eax, dword ptr fs:[00000030h] 12_2_019A9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9240 mov eax, dword ptr fs:[00000030h] 12_2_019A9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9240 mov eax, dword ptr fs:[00000030h] 12_2_019A9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9240 mov eax, dword ptr fs:[00000030h] 12_2_019A9240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E927A mov eax, dword ptr fs:[00000030h] 12_2_019E927A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A34257 mov eax, dword ptr fs:[00000030h] 12_2_01A34257
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A705AC mov eax, dword ptr fs:[00000030h] 12_2_01A705AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A705AC mov eax, dword ptr fs:[00000030h] 12_2_01A705AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A3591 mov eax, dword ptr fs:[00000030h] 12_2_019A3591
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D2581 mov eax, dword ptr fs:[00000030h] 12_2_019D2581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D2581 mov eax, dword ptr fs:[00000030h] 12_2_019D2581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D2581 mov eax, dword ptr fs:[00000030h] 12_2_019D2581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D2581 mov eax, dword ptr fs:[00000030h] 12_2_019D2581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B581 mov eax, dword ptr fs:[00000030h] 12_2_01A6B581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B581 mov eax, dword ptr fs:[00000030h] 12_2_01A6B581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B581 mov eax, dword ptr fs:[00000030h] 12_2_01A6B581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6B581 mov eax, dword ptr fs:[00000030h] 12_2_01A6B581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D35A1 mov eax, dword ptr fs:[00000030h] 12_2_019D35A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D65A0 mov eax, dword ptr fs:[00000030h] 12_2_019D65A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D65A0 mov eax, dword ptr fs:[00000030h] 12_2_019D65A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D65A0 mov eax, dword ptr fs:[00000030h] 12_2_019D65A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A15C1 mov eax, dword ptr fs:[00000030h] 12_2_019A15C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A95F0 mov eax, dword ptr fs:[00000030h] 12_2_019A95F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A95F0 mov ecx, dword ptr fs:[00000030h] 12_2_019A95F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D95EC mov eax, dword ptr fs:[00000030h] 12_2_019D95EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BD5E0 mov eax, dword ptr fs:[00000030h] 12_2_019BD5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BD5E0 mov eax, dword ptr fs:[00000030h] 12_2_019BD5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A751A mov eax, dword ptr fs:[00000030h] 12_2_019A751A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A751A mov eax, dword ptr fs:[00000030h] 12_2_019A751A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A751A mov eax, dword ptr fs:[00000030h] 12_2_019A751A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A751A mov eax, dword ptr fs:[00000030h] 12_2_019A751A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9515 mov ecx, dword ptr fs:[00000030h] 12_2_019A9515
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A2A537 mov eax, dword ptr fs:[00000030h] 12_2_01A2A537
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6E539 mov eax, dword ptr fs:[00000030h] 12_2_01A6E539
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DF527 mov eax, dword ptr fs:[00000030h] 12_2_019DF527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DF527 mov eax, dword ptr fs:[00000030h] 12_2_019DF527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DF527 mov eax, dword ptr fs:[00000030h] 12_2_019DF527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A63518 mov eax, dword ptr fs:[00000030h] 12_2_01A63518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A63518 mov eax, dword ptr fs:[00000030h] 12_2_01A63518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A63518 mov eax, dword ptr fs:[00000030h] 12_2_01A63518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A354C mov eax, dword ptr fs:[00000030h] 12_2_019A354C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A354C mov eax, dword ptr fs:[00000030h] 12_2_019A354C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB540 mov eax, dword ptr fs:[00000030h] 12_2_019AB540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB540 mov eax, dword ptr fs:[00000030h] 12_2_019AB540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A23540 mov eax, dword ptr fs:[00000030h] 12_2_01A23540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CC577 mov eax, dword ptr fs:[00000030h] 12_2_019CC577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CC577 mov eax, dword ptr fs:[00000030h] 12_2_019CC577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B849B mov eax, dword ptr fs:[00000030h] 12_2_019B849B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A649B mov eax, dword ptr fs:[00000030h] 12_2_019A649B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A649B mov eax, dword ptr fs:[00000030h] 12_2_019A649B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A334A0 mov eax, dword ptr fs:[00000030h] 12_2_01A334A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A334A0 mov eax, dword ptr fs:[00000030h] 12_2_01A334A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A334A0 mov eax, dword ptr fs:[00000030h] 12_2_01A334A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A364B5 mov eax, dword ptr fs:[00000030h] 12_2_01A364B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A364B5 mov eax, dword ptr fs:[00000030h] 12_2_01A364B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A1480 mov eax, dword ptr fs:[00000030h] 12_2_019A1480
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B34B1 mov eax, dword ptr fs:[00000030h] 12_2_019B34B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B34B1 mov eax, dword ptr fs:[00000030h] 12_2_019B34B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DD4B0 mov eax, dword ptr fs:[00000030h] 12_2_019DD4B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A64496 mov eax, dword ptr fs:[00000030h] 12_2_01A64496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B14A9 mov eax, dword ptr fs:[00000030h] 12_2_019B14A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B14A9 mov ecx, dword ptr fs:[00000030h] 12_2_019B14A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A614FB mov eax, dword ptr fs:[00000030h] 12_2_01A614FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D84E0 mov eax, dword ptr fs:[00000030h] 12_2_019D84E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D84E0 mov eax, dword ptr fs:[00000030h] 12_2_019D84E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D84E0 mov eax, dword ptr fs:[00000030h] 12_2_019D84E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D84E0 mov eax, dword ptr fs:[00000030h] 12_2_019D84E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D84E0 mov eax, dword ptr fs:[00000030h] 12_2_019D84E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D84E0 mov eax, dword ptr fs:[00000030h] 12_2_019D84E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8410 mov eax, dword ptr fs:[00000030h] 12_2_019A8410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A4439 mov eax, dword ptr fs:[00000030h] 12_2_019A4439
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB433 mov eax, dword ptr fs:[00000030h] 12_2_019BB433
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB433 mov eax, dword ptr fs:[00000030h] 12_2_019BB433
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB433 mov eax, dword ptr fs:[00000030h] 12_2_019BB433
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A7740D mov eax, dword ptr fs:[00000030h] 12_2_01A7740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A7740D mov eax, dword ptr fs:[00000030h] 12_2_01A7740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A7740D mov eax, dword ptr fs:[00000030h] 12_2_01A7740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C2430 mov eax, dword ptr fs:[00000030h] 12_2_019C2430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C2430 mov eax, dword ptr fs:[00000030h] 12_2_019C2430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A9450 mov eax, dword ptr fs:[00000030h] 12_2_019A9450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DA44B mov eax, dword ptr fs:[00000030h] 12_2_019DA44B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB477 mov eax, dword ptr fs:[00000030h] 12_2_019CB477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C746D mov eax, dword ptr fs:[00000030h] 12_2_019C746D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A3C450 mov eax, dword ptr fs:[00000030h] 12_2_01A3C450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A3C450 mov eax, dword ptr fs:[00000030h] 12_2_01A3C450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A78450 mov eax, dword ptr fs:[00000030h] 12_2_01A78450
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8466 mov eax, dword ptr fs:[00000030h] 12_2_019A8466
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8466 mov eax, dword ptr fs:[00000030h] 12_2_019A8466
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B8794 mov eax, dword ptr fs:[00000030h] 12_2_019B8794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B17B5 mov eax, dword ptr fs:[00000030h] 12_2_019B17B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A27794 mov eax, dword ptr fs:[00000030h] 12_2_01A27794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A27794 mov eax, dword ptr fs:[00000030h] 12_2_01A27794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A27794 mov eax, dword ptr fs:[00000030h] 12_2_01A27794
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DD7CA mov eax, dword ptr fs:[00000030h] 12_2_019DD7CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DD7CA mov eax, dword ptr fs:[00000030h] 12_2_019DD7CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A787CF mov eax, dword ptr fs:[00000030h] 12_2_01A787CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E37F5 mov eax, dword ptr fs:[00000030h] 12_2_019E37F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C97ED mov eax, dword ptr fs:[00000030h] 12_2_019C97ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C97ED mov eax, dword ptr fs:[00000030h] 12_2_019C97ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C97ED mov eax, dword ptr fs:[00000030h] 12_2_019C97ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C97ED mov eax, dword ptr fs:[00000030h] 12_2_019C97ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C97ED mov eax, dword ptr fs:[00000030h] 12_2_019C97ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C97ED mov eax, dword ptr fs:[00000030h] 12_2_019C97ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C97ED mov eax, dword ptr fs:[00000030h] 12_2_019C97ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A617D2 mov eax, dword ptr fs:[00000030h] 12_2_01A617D2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D37EB mov eax, dword ptr fs:[00000030h] 12_2_019D37EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D37EB mov eax, dword ptr fs:[00000030h] 12_2_019D37EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D37EB mov eax, dword ptr fs:[00000030h] 12_2_019D37EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D37EB mov eax, dword ptr fs:[00000030h] 12_2_019D37EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D37EB mov eax, dword ptr fs:[00000030h] 12_2_019D37EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D37EB mov eax, dword ptr fs:[00000030h] 12_2_019D37EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D37EB mov eax, dword ptr fs:[00000030h] 12_2_019D37EB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DD715 mov eax, dword ptr fs:[00000030h] 12_2_019DD715
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DD715 mov eax, dword ptr fs:[00000030h] 12_2_019DD715
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CF716 mov eax, dword ptr fs:[00000030h] 12_2_019CF716
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D4710 mov eax, dword ptr fs:[00000030h] 12_2_019D4710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DA70E mov eax, dword ptr fs:[00000030h] 12_2_019DA70E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DA70E mov eax, dword ptr fs:[00000030h] 12_2_019DA70E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DC707 mov eax, dword ptr fs:[00000030h] 12_2_019DC707
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DC707 mov ecx, dword ptr fs:[00000030h] 12_2_019DC707
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DC707 mov eax, dword ptr fs:[00000030h] 12_2_019DC707
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB73D mov eax, dword ptr fs:[00000030h] 12_2_019CB73D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB73D mov eax, dword ptr fs:[00000030h] 12_2_019CB73D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A7070D mov eax, dword ptr fs:[00000030h] 12_2_01A7070D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A7070D mov eax, dword ptr fs:[00000030h] 12_2_01A7070D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A6730 mov eax, dword ptr fs:[00000030h] 12_2_019A6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A6730 mov eax, dword ptr fs:[00000030h] 12_2_019A6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A6730 mov eax, dword ptr fs:[00000030h] 12_2_019A6730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DE730 mov eax, dword ptr fs:[00000030h] 12_2_019DE730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AA745 mov eax, dword ptr fs:[00000030h] 12_2_019AA745
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A61751 mov eax, dword ptr fs:[00000030h] 12_2_01A61751
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov ecx, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A8760 mov eax, dword ptr fs:[00000030h] 12_2_019A8760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CE760 mov eax, dword ptr fs:[00000030h] 12_2_019CE760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CE760 mov eax, dword ptr fs:[00000030h] 12_2_019CE760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A246A7 mov eax, dword ptr fs:[00000030h] 12_2_01A246A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A656B6 mov eax, dword ptr fs:[00000030h] 12_2_01A656B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A656B6 mov eax, dword ptr fs:[00000030h] 12_2_01A656B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A86A0 mov eax, dword ptr fs:[00000030h] 12_2_019A86A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D36CC mov eax, dword ptr fs:[00000030h] 12_2_019D36CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov ecx, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D06C0 mov eax, dword ptr fs:[00000030h] 12_2_019D06C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B76E2 mov eax, dword ptr fs:[00000030h] 12_2_019B76E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D16E0 mov ecx, dword ptr fs:[00000030h] 12_2_019D16E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DA61C mov eax, dword ptr fs:[00000030h] 12_2_019DA61C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DA61C mov eax, dword ptr fs:[00000030h] 12_2_019DA61C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A25623 mov eax, dword ptr fs:[00000030h] 12_2_01A25623
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B161A mov eax, dword ptr fs:[00000030h] 12_2_019B161A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A1618 mov eax, dword ptr fs:[00000030h] 12_2_019A1618
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AC600 mov eax, dword ptr fs:[00000030h] 12_2_019AC600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AC600 mov eax, dword ptr fs:[00000030h] 12_2_019AC600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AC600 mov eax, dword ptr fs:[00000030h] 12_2_019AC600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov ecx, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov ecx, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov ecx, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov ecx, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C5600 mov eax, dword ptr fs:[00000030h] 12_2_019C5600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DC63D mov eax, dword ptr fs:[00000030h] 12_2_019DC63D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AA63B mov eax, dword ptr fs:[00000030h] 12_2_019AA63B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AA63B mov eax, dword ptr fs:[00000030h] 12_2_019AA63B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A61608 mov eax, dword ptr fs:[00000030h] 12_2_01A61608
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB62E mov eax, dword ptr fs:[00000030h] 12_2_019BB62E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019BB62E mov eax, dword ptr fs:[00000030h] 12_2_019BB62E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AE620 mov eax, dword ptr fs:[00000030h] 12_2_019AE620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D7620 mov eax, dword ptr fs:[00000030h] 12_2_019D7620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D7620 mov eax, dword ptr fs:[00000030h] 12_2_019D7620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D7620 mov eax, dword ptr fs:[00000030h] 12_2_019D7620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D7620 mov eax, dword ptr fs:[00000030h] 12_2_019D7620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D7620 mov eax, dword ptr fs:[00000030h] 12_2_019D7620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D7620 mov eax, dword ptr fs:[00000030h] 12_2_019D7620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4670 mov eax, dword ptr fs:[00000030h] 12_2_019C4670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4670 mov eax, dword ptr fs:[00000030h] 12_2_019C4670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4670 mov eax, dword ptr fs:[00000030h] 12_2_019C4670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C4670 mov eax, dword ptr fs:[00000030h] 12_2_019C4670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A36652 mov eax, dword ptr fs:[00000030h] 12_2_01A36652
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B766D mov eax, dword ptr fs:[00000030h] 12_2_019B766D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A649A4 mov eax, dword ptr fs:[00000030h] 12_2_01A649A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A649A4 mov eax, dword ptr fs:[00000030h] 12_2_01A649A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A649A4 mov eax, dword ptr fs:[00000030h] 12_2_01A649A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A649A4 mov eax, dword ptr fs:[00000030h] 12_2_01A649A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A269A6 mov eax, dword ptr fs:[00000030h] 12_2_01A269A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AB990 mov eax, dword ptr fs:[00000030h] 12_2_019AB990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D2990 mov eax, dword ptr fs:[00000030h] 12_2_019D2990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D99BC mov eax, dword ptr fs:[00000030h] 12_2_019D99BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DC9BF mov eax, dword ptr fs:[00000030h] 12_2_019DC9BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019DC9BF mov eax, dword ptr fs:[00000030h] 12_2_019DC9BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov ecx, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov ecx, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov eax, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov ecx, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov ecx, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov eax, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov ecx, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov ecx, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov eax, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov ecx, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov ecx, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019C99BF mov eax, dword ptr fs:[00000030h] 12_2_019C99BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A789E7 mov eax, dword ptr fs:[00000030h] 12_2_01A789E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B99C7 mov eax, dword ptr fs:[00000030h] 12_2_019B99C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B99C7 mov eax, dword ptr fs:[00000030h] 12_2_019B99C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B99C7 mov eax, dword ptr fs:[00000030h] 12_2_019B99C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B99C7 mov eax, dword ptr fs:[00000030h] 12_2_019B99C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AC9FF mov eax, dword ptr fs:[00000030h] 12_2_019AC9FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AC9FF mov eax, dword ptr fs:[00000030h] 12_2_019AC9FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AC9FF mov eax, dword ptr fs:[00000030h] 12_2_019AC9FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A619D8 mov eax, dword ptr fs:[00000030h] 12_2_01A619D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B1915 mov eax, dword ptr fs:[00000030h] 12_2_019B1915
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B1915 mov eax, dword ptr fs:[00000030h] 12_2_019B1915
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A78966 mov eax, dword ptr fs:[00000030h] 12_2_01A78966
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A6E962 mov eax, dword ptr fs:[00000030h] 12_2_01A6E962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A395E mov eax, dword ptr fs:[00000030h] 12_2_019A395E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A395E mov eax, dword ptr fs:[00000030h] 12_2_019A395E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB944 mov eax, dword ptr fs:[00000030h] 12_2_019CB944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019CB944 mov eax, dword ptr fs:[00000030h] 12_2_019CB944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A61951 mov eax, dword ptr fs:[00000030h] 12_2_01A61951
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019AC962 mov eax, dword ptr fs:[00000030h] 12_2_019AC962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A3880 mov eax, dword ptr fs:[00000030h] 12_2_019A3880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019A3880 mov eax, dword ptr fs:[00000030h] 12_2_019A3880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A23884 mov eax, dword ptr fs:[00000030h] 12_2_01A23884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_01A23884 mov eax, dword ptr fs:[00000030h] 12_2_01A23884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B28AE mov eax, dword ptr fs:[00000030h] 12_2_019B28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B28AE mov eax, dword ptr fs:[00000030h] 12_2_019B28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B28AE mov eax, dword ptr fs:[00000030h] 12_2_019B28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B28AE mov ecx, dword ptr fs:[00000030h] 12_2_019B28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B28AE mov eax, dword ptr fs:[00000030h] 12_2_019B28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019B28AE mov eax, dword ptr fs:[00000030h] 12_2_019B28AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D78A0 mov eax, dword ptr fs:[00000030h] 12_2_019D78A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019D78A0 mov eax, dword ptr fs:[00000030h] 12_2_019D78A0
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Code function: 12_2_019E96E0 NtFreeVirtualMemory,LdrInitializeThunk, 12_2_019E96E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Jump to behavior

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Variant.Bulz.785643.17886.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.45332e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.44dc2c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.302341566.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.300583047.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 12.0.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.45332e0.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SecuriteInfo.com.Variant.Bulz.785643.17886.exe.44dc2c0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0000000C.00000000.299984624.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.302341566.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000000.300583047.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.303196855.0000000004399000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 552971 Sample: SecuriteInfo.com.Variant.Bu... Startdate: 14/01/2022 Architecture: WINDOWS Score: 100 14 Found malware configuration 2->14 16 Malicious sample detected (through community Yara rule) 2->16 18 Antivirus detection for URL or domain 2->18 20 8 other signatures 2->20 6 SecuriteInfo.com.Variant.Bulz.785643.17886.exe 3 2->6         started        process3 file4 12 SecuriteInfo.com.V...85643.17886.exe.log, ASCII 6->12 dropped 22 Tries to detect virtualization through RDTSC time measurements 6->22 24 Injects a PE file into a foreign processes 6->24 10 SecuriteInfo.com.Variant.Bulz.785643.17886.exe 6->10         started        signatures5 process6
No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.topeasyip.company/i5nb/ true
  • 4%, Virustotal, Browse
  • Avira URL Cloud: malware
 low