Windows Analysis Report
FT - 08082022.exe

Overview

General Information

Sample Name: FT - 08082022.exe
Analysis ID: 680396
MD5: 70b100ea1e1466a56a78d3a31dae1e2a
SHA1: aa775a962d1a1714f06e15f03e244435b52eedfc
SHA256: 58f41297482040338766f554cca18e61888eaf9a9123e2570f48b89a31b601ac
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Yara detected FormBook
Malicious sample detected (through community Yara rule)
Antivirus / Scanner detection for submitted sample
Maps a DLL or memory area into another process
Machine Learning detection for sample
.NET source code contains potential unpacker
Yara detected Generic Downloader
Queues an APC in another process (thread injection)
.NET source code contains very large array initializations
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Yara detected FormBook
Source: Yara match File source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Antivirus / Scanner detection for submitted sample
Source: FT - 08082022.exe Avira: detected
Machine Learning detection for sample
Source: FT - 08082022.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 14.0.InstallUtil.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.mcphiecabinetry.site/iw01/"], "decoy": ["searchandreach.com", "exhaustinternational.com", "megadarknetz.online", "naiti.pro", "bizcon-h.com", "unitatem.com", "sangeetapallai.site", "tradingwithwallstreet.com", "wwwvestmed.com", "tendful.top", "sezonuyakala.com", "mindlabpublishing.com", "barnwoodconnection.com", "smokehighsociety.com", "axelarigatosaopaulo.com", "cadence.ink", "zhaokl.net", "lwz168.com", "aladdinmkstore.com", "beyondexpawtationpetcare.com", "buckscountyprolife.info", "myangel.today", "haxtrldesign.xyz", "inselite.com", "hamshor.com", "soulpets.net", "cassettebeauty.com", "begonvilrestaurant.com", "preciuss.info", "bbjmw.com", "engr360.site", "sv388vip.xyz", "wealthofawoman.net", "futuresmartafricanonprofit.net", "dgshanteng.com", "hongtaoshunshun.top", "thebrowandbeautyplug.com", "bkeight.xyz", "aaguiapousou.com", "swingsandthings.store", "pdsbxw.com", "925xd.com", "huntervalley.online", "dostuff.tech", "tgydf.com", "texasexchange.info", "ralonllc.net", "deneyimrulman.online", "1xbet-wix.top", "aqnest.net", "worthdisk.com", "bpw-finland.com", "secured-vision-unit.com", "bc6029.com", "theunrulyplot.co.uk", "mvvezasi.site", "saferhennepin.com", "sunscreensale.store", "sdplci.com", "sou1xia.net", "gzgztf.top", "airriflehunt.com", "accwatercraft.com", "rscorecalculator.com"]}
Uses 32bit PE files
Source: FT - 08082022.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: FT - 08082022.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: InstallUtil.exe, 0000000E.00000003.337295908.0000000000E55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.516873753.0000000001190000.00000040.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.342676906.0000000000FF9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: InstallUtil.exe, InstallUtil.exe, 0000000E.00000003.337295908.0000000000E55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.516873753.0000000001190000.00000040.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.342676906.0000000000FF9000.00000004.00000800.00020000.00000000.sdmp

Networking
barindex
Yara detected Generic Downloader
Source: Yara match File source: 0.2.FT - 08082022.exe.d480000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.359453722.000000000D480000.00000004.08000000.00040000.00000000.sdmp, type: MEMORY
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.mcphiecabinetry.site/iw01/
Source: FT - 08082022.exe, 00000000.00000002.346131077.0000000002D31000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://google.com
Source: FT - 08082022.exe, 00000000.00000002.348247508.0000000002E4F000.00000004.00000800.00020000.00000000.sdmp, FT - 08082022.exe, 00000000.00000002.346772186.0000000002D7A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://james.newtonking.com/projects/json
Source: FT - 08082022.exe, 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, FT - 08082022.exe, 00000000.00000002.359453722.000000000D480000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.newtonsoft.com/jsonschema
Source: FT - 08082022.exe, 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, FT - 08082022.exe, 00000000.00000002.359453722.000000000D480000.00000004.08000000.00040000.00000000.sdmp String found in binary or memory: https://www.nuget.org/packages/Newtonsoft.Json.Bson

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.347927328.0000000002E22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: FT - 08082022.exe PID: 1144, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: InstallUtil.exe PID: 5412, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
.NET source code contains very large array initializations
Source: FT - 08082022.exe, iahb.cs Large array initialization: oqed: array initializer size 2000384
Uses 32bit PE files
Source: FT - 08082022.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.347927328.0000000002E22000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: FT - 08082022.exe PID: 1144, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: InstallUtil.exe PID: 5412, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Detected potential crypto function
Source: C:\Users\user\Desktop\FT - 08082022.exe Code function: 0_2_010BDAA5 0_2_010BDAA5
Source: C:\Users\user\Desktop\FT - 08082022.exe Code function: 0_2_010BDAC0 0_2_010BDAC0
Source: C:\Users\user\Desktop\FT - 08082022.exe Code function: 0_2_010BBF14 0_2_010BBF14
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BF900 14_2_011BF900
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01282D07 14_2_01282D07
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B0D20 14_2_011B0D20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D4120 14_2_011D4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01281D55 14_2_01281D55
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2581 14_2_011E2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CD5E0 14_2_011CD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C841F 14_2_011C841F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271002 14_2_01271002
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012820A8 14_2_012820A8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CB090 14_2_011CB090
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E20A0 14_2_011E20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01282B28 14_2_01282B28
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EEBB0 14_2_011EEBB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01281FF1 14_2_01281FF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D6E30 14_2_011D6E30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012822AE 14_2_012822AE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01282EF7 14_2_01282EF7
Found potential string decryption / allocating functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: String function: 011BB150 appears 35 times
Contains functionality to call native functions
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 14_2_011F9910
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F99A0 NtCreateSection,LdrInitializeThunk, 14_2_011F99A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F95D0 NtClose,LdrInitializeThunk, 14_2_011F95D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9840 NtDelayExecution,LdrInitializeThunk, 14_2_011F9840
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9860 NtQuerySystemInformation,LdrInitializeThunk, 14_2_011F9860
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F98F0 NtReadVirtualMemory,LdrInitializeThunk, 14_2_011F98F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9710 NtQueryInformationToken,LdrInitializeThunk, 14_2_011F9710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9780 NtMapViewOfSection,LdrInitializeThunk, 14_2_011F9780
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9A00 NtProtectVirtualMemory,LdrInitializeThunk, 14_2_011F9A00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9A50 NtCreateFile,LdrInitializeThunk, 14_2_011F9A50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9660 NtAllocateVirtualMemory,LdrInitializeThunk, 14_2_011F9660
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F96E0 NtFreeVirtualMemory,LdrInitializeThunk, 14_2_011F96E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011FAD30 NtSetContextThread, 14_2_011FAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9520 NtWaitForSingleObject, 14_2_011F9520
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9950 NtQueueApcThread, 14_2_011F9950
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9540 NtReadFile, 14_2_011F9540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9560 NtWriteFile, 14_2_011F9560
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F99D0 NtCreateProcessEx, 14_2_011F99D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F95F0 NtQueryInformationFile, 14_2_011F95F0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9820 NtEnumerateKey, 14_2_011F9820
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011FB040 NtSuspendThread, 14_2_011FB040
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F98A0 NtWriteVirtualMemory, 14_2_011F98A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011FA710 NtOpenProcessToken, 14_2_011FA710
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9B00 NtSetValueKey, 14_2_011F9B00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9730 NtQueryVirtualMemory, 14_2_011F9730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9770 NtSetInformationFile, 14_2_011F9770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011FA770 NtOpenThread, 14_2_011FA770
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9760 NtOpenProcess, 14_2_011F9760
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011FA3B0 NtGetContextThread, 14_2_011FA3B0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F97A0 NtUnmapViewOfSection, 14_2_011F97A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9FE0 NtCreateMutant, 14_2_011F9FE0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9610 NtEnumerateValueKey, 14_2_011F9610
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9A10 NtQuerySection, 14_2_011F9A10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9A20 NtResumeThread, 14_2_011F9A20
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9650 NtQueryValueKey, 14_2_011F9650
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9670 NtQueryInformationProcess, 14_2_011F9670
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9A80 NtOpenDirectoryObject, 14_2_011F9A80
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F96D0 NtCreateKey, 14_2_011F96D0
Sample file is different than original file name gathered from version info
Source: FT - 08082022.exe, 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameXkmjgdlcz.dll" vs FT - 08082022.exe
Source: FT - 08082022.exe, 00000000.00000002.359453722.000000000D480000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameXkmjgdlcz.dll" vs FT - 08082022.exe
Source: FT - 08082022.exe, 00000000.00000002.346337239.0000000002D45000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilename vs FT - 08082022.exe
Source: FT - 08082022.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\FT - 08082022.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\FT - 08082022.exe "C:\Users\user\Desktop\FT - 08082022.exe"
Source: C:\Users\user\Desktop\FT - 08082022.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
Source: C:\Users\user\Desktop\FT - 08082022.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FT - 08082022.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@3/1@0/0
Source: FT - 08082022.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\FT - 08082022.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: FT - 08082022.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: FT - 08082022.exe Static file information: File size 2009088 > 1048576
Source: FT - 08082022.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: FT - 08082022.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x1e9a00
Source: FT - 08082022.exe Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: InstallUtil.exe, 0000000E.00000003.337295908.0000000000E55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.516873753.0000000001190000.00000040.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.342676906.0000000000FF9000.00000004.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: InstallUtil.exe, InstallUtil.exe, 0000000E.00000003.337295908.0000000000E55000.00000004.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000002.516873753.0000000001190000.00000040.00000800.00020000.00000000.sdmp, InstallUtil.exe, 0000000E.00000003.342676906.0000000000FF9000.00000004.00000800.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: FT - 08082022.exe, iaha.cs .Net Code: irug System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\FT - 08082022.exe Code function: 0_2_010BEAB0 push esp; iretd 0_2_010BEDB1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0120D0D1 push ecx; ret 14_2_0120D0E4
Source: initial sample Static PE information: section name: .text entropy: 6.846947333897607
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\FT - 08082022.exe TID: 5272 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F6DE6 rdtsc 14_2_011F6DE6
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\FT - 08082022.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe API coverage: 4.5 %
Source: C:\Users\user\Desktop\FT - 08082022.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 0000000F.00000000.461776192.00000000051AC000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000F.00000000.465900025.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000F.00000000.434370145.00000000051F7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: -94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}71USER
Source: explorer.exe, 0000000F.00000000.465900025.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 0000000F.00000000.439500528.0000000005EAB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000F.00000000.373162972.0000000005137000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 0000000F.00000000.434370145.00000000051F7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: FT - 08082022.exe, 00000000.00000003.237438564.0000000003D5A000.00000004.00000800.00020000.00000000.sdmp, FT - 08082022.exe, 00000000.00000000.234085669.0000000000682000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: KhGfStJh
Source: explorer.exe, 0000000F.00000000.373162972.0000000005137000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 0000000F.00000000.465900025.0000000006005000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00dRom0cY
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F6DE6 rdtsc 14_2_011F6DE6
Enables debug privileges
Source: C:\Users\user\Desktop\FT - 08082022.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0123A537 mov eax, dword ptr fs:[00000030h] 14_2_0123A537
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B9100 mov eax, dword ptr fs:[00000030h] 14_2_011B9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B9100 mov eax, dword ptr fs:[00000030h] 14_2_011B9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B9100 mov eax, dword ptr fs:[00000030h] 14_2_011B9100
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01288D34 mov eax, dword ptr fs:[00000030h] 14_2_01288D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E513A mov eax, dword ptr fs:[00000030h] 14_2_011E513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E513A mov eax, dword ptr fs:[00000030h] 14_2_011E513A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E4D3B mov eax, dword ptr fs:[00000030h] 14_2_011E4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E4D3B mov eax, dword ptr fs:[00000030h] 14_2_011E4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E4D3B mov eax, dword ptr fs:[00000030h] 14_2_011E4D3B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C3D34 mov eax, dword ptr fs:[00000030h] 14_2_011C3D34
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BAD30 mov eax, dword ptr fs:[00000030h] 14_2_011BAD30
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D4120 mov eax, dword ptr fs:[00000030h] 14_2_011D4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D4120 mov eax, dword ptr fs:[00000030h] 14_2_011D4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D4120 mov eax, dword ptr fs:[00000030h] 14_2_011D4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D4120 mov eax, dword ptr fs:[00000030h] 14_2_011D4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D4120 mov ecx, dword ptr fs:[00000030h] 14_2_011D4120
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D7D50 mov eax, dword ptr fs:[00000030h] 14_2_011D7D50
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DB944 mov eax, dword ptr fs:[00000030h] 14_2_011DB944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DB944 mov eax, dword ptr fs:[00000030h] 14_2_011DB944
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F3D43 mov eax, dword ptr fs:[00000030h] 14_2_011F3D43
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01233540 mov eax, dword ptr fs:[00000030h] 14_2_01233540
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BB171 mov eax, dword ptr fs:[00000030h] 14_2_011BB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BB171 mov eax, dword ptr fs:[00000030h] 14_2_011BB171
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DC577 mov eax, dword ptr fs:[00000030h] 14_2_011DC577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DC577 mov eax, dword ptr fs:[00000030h] 14_2_011DC577
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BC962 mov eax, dword ptr fs:[00000030h] 14_2_011BC962
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012805AC mov eax, dword ptr fs:[00000030h] 14_2_012805AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012805AC mov eax, dword ptr fs:[00000030h] 14_2_012805AC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EFD9B mov eax, dword ptr fs:[00000030h] 14_2_011EFD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EFD9B mov eax, dword ptr fs:[00000030h] 14_2_011EFD9B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012369A6 mov eax, dword ptr fs:[00000030h] 14_2_012369A6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2990 mov eax, dword ptr fs:[00000030h] 14_2_011E2990
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B2D8A mov eax, dword ptr fs:[00000030h] 14_2_011B2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B2D8A mov eax, dword ptr fs:[00000030h] 14_2_011B2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B2D8A mov eax, dword ptr fs:[00000030h] 14_2_011B2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B2D8A mov eax, dword ptr fs:[00000030h] 14_2_011B2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B2D8A mov eax, dword ptr fs:[00000030h] 14_2_011B2D8A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EA185 mov eax, dword ptr fs:[00000030h] 14_2_011EA185
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012351BE mov eax, dword ptr fs:[00000030h] 14_2_012351BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012351BE mov eax, dword ptr fs:[00000030h] 14_2_012351BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012351BE mov eax, dword ptr fs:[00000030h] 14_2_012351BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012351BE mov eax, dword ptr fs:[00000030h] 14_2_012351BE
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DC182 mov eax, dword ptr fs:[00000030h] 14_2_011DC182
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2581 mov eax, dword ptr fs:[00000030h] 14_2_011E2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2581 mov eax, dword ptr fs:[00000030h] 14_2_011E2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2581 mov eax, dword ptr fs:[00000030h] 14_2_011E2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2581 mov eax, dword ptr fs:[00000030h] 14_2_011E2581
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E1DB5 mov eax, dword ptr fs:[00000030h] 14_2_011E1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E1DB5 mov eax, dword ptr fs:[00000030h] 14_2_011E1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E1DB5 mov eax, dword ptr fs:[00000030h] 14_2_011E1DB5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E61A0 mov eax, dword ptr fs:[00000030h] 14_2_011E61A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E61A0 mov eax, dword ptr fs:[00000030h] 14_2_011E61A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E35A1 mov eax, dword ptr fs:[00000030h] 14_2_011E35A1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012441E8 mov eax, dword ptr fs:[00000030h] 14_2_012441E8
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01268DF1 mov eax, dword ptr fs:[00000030h] 14_2_01268DF1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236DC9 mov eax, dword ptr fs:[00000030h] 14_2_01236DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236DC9 mov eax, dword ptr fs:[00000030h] 14_2_01236DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236DC9 mov eax, dword ptr fs:[00000030h] 14_2_01236DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236DC9 mov ecx, dword ptr fs:[00000030h] 14_2_01236DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236DC9 mov eax, dword ptr fs:[00000030h] 14_2_01236DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236DC9 mov eax, dword ptr fs:[00000030h] 14_2_01236DC9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BB1E1 mov eax, dword ptr fs:[00000030h] 14_2_011BB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BB1E1 mov eax, dword ptr fs:[00000030h] 14_2_011BB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BB1E1 mov eax, dword ptr fs:[00000030h] 14_2_011BB1E1
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CD5E0 mov eax, dword ptr fs:[00000030h] 14_2_011CD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CD5E0 mov eax, dword ptr fs:[00000030h] 14_2_011CD5E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271C06 mov eax, dword ptr fs:[00000030h] 14_2_01271C06
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0128740D mov eax, dword ptr fs:[00000030h] 14_2_0128740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0128740D mov eax, dword ptr fs:[00000030h] 14_2_0128740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0128740D mov eax, dword ptr fs:[00000030h] 14_2_0128740D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236C0A mov eax, dword ptr fs:[00000030h] 14_2_01236C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236C0A mov eax, dword ptr fs:[00000030h] 14_2_01236C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236C0A mov eax, dword ptr fs:[00000030h] 14_2_01236C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236C0A mov eax, dword ptr fs:[00000030h] 14_2_01236C0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EBC2C mov eax, dword ptr fs:[00000030h] 14_2_011EBC2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E002D mov eax, dword ptr fs:[00000030h] 14_2_011E002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E002D mov eax, dword ptr fs:[00000030h] 14_2_011E002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E002D mov eax, dword ptr fs:[00000030h] 14_2_011E002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E002D mov eax, dword ptr fs:[00000030h] 14_2_011E002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E002D mov eax, dword ptr fs:[00000030h] 14_2_011E002D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01237016 mov eax, dword ptr fs:[00000030h] 14_2_01237016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01237016 mov eax, dword ptr fs:[00000030h] 14_2_01237016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01237016 mov eax, dword ptr fs:[00000030h] 14_2_01237016
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CB02A mov eax, dword ptr fs:[00000030h] 14_2_011CB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CB02A mov eax, dword ptr fs:[00000030h] 14_2_011CB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CB02A mov eax, dword ptr fs:[00000030h] 14_2_011CB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CB02A mov eax, dword ptr fs:[00000030h] 14_2_011CB02A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01284015 mov eax, dword ptr fs:[00000030h] 14_2_01284015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01284015 mov eax, dword ptr fs:[00000030h] 14_2_01284015
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D0050 mov eax, dword ptr fs:[00000030h] 14_2_011D0050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D0050 mov eax, dword ptr fs:[00000030h] 14_2_011D0050
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01272073 mov eax, dword ptr fs:[00000030h] 14_2_01272073
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EA44B mov eax, dword ptr fs:[00000030h] 14_2_011EA44B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01281074 mov eax, dword ptr fs:[00000030h] 14_2_01281074
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D746D mov eax, dword ptr fs:[00000030h] 14_2_011D746D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124C450 mov eax, dword ptr fs:[00000030h] 14_2_0124C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124C450 mov eax, dword ptr fs:[00000030h] 14_2_0124C450
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C849B mov eax, dword ptr fs:[00000030h] 14_2_011C849B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B9080 mov eax, dword ptr fs:[00000030h] 14_2_011B9080
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EF0BF mov ecx, dword ptr fs:[00000030h] 14_2_011EF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EF0BF mov eax, dword ptr fs:[00000030h] 14_2_011EF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EF0BF mov eax, dword ptr fs:[00000030h] 14_2_011EF0BF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01233884 mov eax, dword ptr fs:[00000030h] 14_2_01233884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01233884 mov eax, dword ptr fs:[00000030h] 14_2_01233884
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F90AF mov eax, dword ptr fs:[00000030h] 14_2_011F90AF
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E20A0 mov eax, dword ptr fs:[00000030h] 14_2_011E20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E20A0 mov eax, dword ptr fs:[00000030h] 14_2_011E20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E20A0 mov eax, dword ptr fs:[00000030h] 14_2_011E20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E20A0 mov eax, dword ptr fs:[00000030h] 14_2_011E20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E20A0 mov eax, dword ptr fs:[00000030h] 14_2_011E20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E20A0 mov eax, dword ptr fs:[00000030h] 14_2_011E20A0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236CF0 mov eax, dword ptr fs:[00000030h] 14_2_01236CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236CF0 mov eax, dword ptr fs:[00000030h] 14_2_01236CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01236CF0 mov eax, dword ptr fs:[00000030h] 14_2_01236CF0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012714FB mov eax, dword ptr fs:[00000030h] 14_2_012714FB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0124B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124B8D0 mov ecx, dword ptr fs:[00000030h] 14_2_0124B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0124B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0124B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0124B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124B8D0 mov eax, dword ptr fs:[00000030h] 14_2_0124B8D0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B58EC mov eax, dword ptr fs:[00000030h] 14_2_011B58EC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01288CD6 mov eax, dword ptr fs:[00000030h] 14_2_01288CD6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DF716 mov eax, dword ptr fs:[00000030h] 14_2_011DF716
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EA70E mov eax, dword ptr fs:[00000030h] 14_2_011EA70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EA70E mov eax, dword ptr fs:[00000030h] 14_2_011EA70E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0128070D mov eax, dword ptr fs:[00000030h] 14_2_0128070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0128070D mov eax, dword ptr fs:[00000030h] 14_2_0128070D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EE730 mov eax, dword ptr fs:[00000030h] 14_2_011EE730
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124FF10 mov eax, dword ptr fs:[00000030h] 14_2_0124FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124FF10 mov eax, dword ptr fs:[00000030h] 14_2_0124FF10
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B4F2E mov eax, dword ptr fs:[00000030h] 14_2_011B4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B4F2E mov eax, dword ptr fs:[00000030h] 14_2_011B4F2E
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0127131B mov eax, dword ptr fs:[00000030h] 14_2_0127131B
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01288F6A mov eax, dword ptr fs:[00000030h] 14_2_01288F6A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BF358 mov eax, dword ptr fs:[00000030h] 14_2_011BF358
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BDB40 mov eax, dword ptr fs:[00000030h] 14_2_011BDB40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CEF40 mov eax, dword ptr fs:[00000030h] 14_2_011CEF40
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E3B7A mov eax, dword ptr fs:[00000030h] 14_2_011E3B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E3B7A mov eax, dword ptr fs:[00000030h] 14_2_011E3B7A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01288B58 mov eax, dword ptr fs:[00000030h] 14_2_01288B58
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BDB60 mov ecx, dword ptr fs:[00000030h] 14_2_011BDB60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CFF60 mov eax, dword ptr fs:[00000030h] 14_2_011CFF60
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C8794 mov eax, dword ptr fs:[00000030h] 14_2_011C8794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2397 mov eax, dword ptr fs:[00000030h] 14_2_011E2397
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01285BA5 mov eax, dword ptr fs:[00000030h] 14_2_01285BA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EB390 mov eax, dword ptr fs:[00000030h] 14_2_011EB390
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C1B8F mov eax, dword ptr fs:[00000030h] 14_2_011C1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C1B8F mov eax, dword ptr fs:[00000030h] 14_2_011C1B8F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0126D380 mov ecx, dword ptr fs:[00000030h] 14_2_0126D380
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0127138A mov eax, dword ptr fs:[00000030h] 14_2_0127138A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E4BAD mov eax, dword ptr fs:[00000030h] 14_2_011E4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E4BAD mov eax, dword ptr fs:[00000030h] 14_2_011E4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E4BAD mov eax, dword ptr fs:[00000030h] 14_2_011E4BAD
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01237794 mov eax, dword ptr fs:[00000030h] 14_2_01237794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01237794 mov eax, dword ptr fs:[00000030h] 14_2_01237794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01237794 mov eax, dword ptr fs:[00000030h] 14_2_01237794
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012353CA mov eax, dword ptr fs:[00000030h] 14_2_012353CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012353CA mov eax, dword ptr fs:[00000030h] 14_2_012353CA
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F37F5 mov eax, dword ptr fs:[00000030h] 14_2_011F37F5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DDBE9 mov eax, dword ptr fs:[00000030h] 14_2_011DDBE9
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E03E2 mov eax, dword ptr fs:[00000030h] 14_2_011E03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E03E2 mov eax, dword ptr fs:[00000030h] 14_2_011E03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E03E2 mov eax, dword ptr fs:[00000030h] 14_2_011E03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E03E2 mov eax, dword ptr fs:[00000030h] 14_2_011E03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E03E2 mov eax, dword ptr fs:[00000030h] 14_2_011E03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E03E2 mov eax, dword ptr fs:[00000030h] 14_2_011E03E2
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011D3A1C mov eax, dword ptr fs:[00000030h] 14_2_011D3A1C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EA61C mov eax, dword ptr fs:[00000030h] 14_2_011EA61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EA61C mov eax, dword ptr fs:[00000030h] 14_2_011EA61C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B5210 mov eax, dword ptr fs:[00000030h] 14_2_011B5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B5210 mov ecx, dword ptr fs:[00000030h] 14_2_011B5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B5210 mov eax, dword ptr fs:[00000030h] 14_2_011B5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B5210 mov eax, dword ptr fs:[00000030h] 14_2_011B5210
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BAA16 mov eax, dword ptr fs:[00000030h] 14_2_011BAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BAA16 mov eax, dword ptr fs:[00000030h] 14_2_011BAA16
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C8A0A mov eax, dword ptr fs:[00000030h] 14_2_011C8A0A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0126FE3F mov eax, dword ptr fs:[00000030h] 14_2_0126FE3F
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BC600 mov eax, dword ptr fs:[00000030h] 14_2_011BC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BC600 mov eax, dword ptr fs:[00000030h] 14_2_011BC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BC600 mov eax, dword ptr fs:[00000030h] 14_2_011BC600
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E8E00 mov eax, dword ptr fs:[00000030h] 14_2_011E8E00
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01271608 mov eax, dword ptr fs:[00000030h] 14_2_01271608
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F4A2C mov eax, dword ptr fs:[00000030h] 14_2_011F4A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F4A2C mov eax, dword ptr fs:[00000030h] 14_2_011F4A2C
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011BE620 mov eax, dword ptr fs:[00000030h] 14_2_011BE620
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0126B260 mov eax, dword ptr fs:[00000030h] 14_2_0126B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0126B260 mov eax, dword ptr fs:[00000030h] 14_2_0126B260
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01288A62 mov eax, dword ptr fs:[00000030h] 14_2_01288A62
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B9240 mov eax, dword ptr fs:[00000030h] 14_2_011B9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B9240 mov eax, dword ptr fs:[00000030h] 14_2_011B9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B9240 mov eax, dword ptr fs:[00000030h] 14_2_011B9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B9240 mov eax, dword ptr fs:[00000030h] 14_2_011B9240
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C7E41 mov eax, dword ptr fs:[00000030h] 14_2_011C7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C7E41 mov eax, dword ptr fs:[00000030h] 14_2_011C7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C7E41 mov eax, dword ptr fs:[00000030h] 14_2_011C7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C7E41 mov eax, dword ptr fs:[00000030h] 14_2_011C7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C7E41 mov eax, dword ptr fs:[00000030h] 14_2_011C7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C7E41 mov eax, dword ptr fs:[00000030h] 14_2_011C7E41
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F927A mov eax, dword ptr fs:[00000030h] 14_2_011F927A
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DAE73 mov eax, dword ptr fs:[00000030h] 14_2_011DAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DAE73 mov eax, dword ptr fs:[00000030h] 14_2_011DAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DAE73 mov eax, dword ptr fs:[00000030h] 14_2_011DAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DAE73 mov eax, dword ptr fs:[00000030h] 14_2_011DAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011DAE73 mov eax, dword ptr fs:[00000030h] 14_2_011DAE73
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C766D mov eax, dword ptr fs:[00000030h] 14_2_011C766D
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01244257 mov eax, dword ptr fs:[00000030h] 14_2_01244257
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_012346A7 mov eax, dword ptr fs:[00000030h] 14_2_012346A7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011ED294 mov eax, dword ptr fs:[00000030h] 14_2_011ED294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011ED294 mov eax, dword ptr fs:[00000030h] 14_2_011ED294
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01280EA5 mov eax, dword ptr fs:[00000030h] 14_2_01280EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01280EA5 mov eax, dword ptr fs:[00000030h] 14_2_01280EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01280EA5 mov eax, dword ptr fs:[00000030h] 14_2_01280EA5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0124FE87 mov eax, dword ptr fs:[00000030h] 14_2_0124FE87
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CAAB0 mov eax, dword ptr fs:[00000030h] 14_2_011CAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011CAAB0 mov eax, dword ptr fs:[00000030h] 14_2_011CAAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011EFAB0 mov eax, dword ptr fs:[00000030h] 14_2_011EFAB0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B52A5 mov eax, dword ptr fs:[00000030h] 14_2_011B52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B52A5 mov eax, dword ptr fs:[00000030h] 14_2_011B52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B52A5 mov eax, dword ptr fs:[00000030h] 14_2_011B52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B52A5 mov eax, dword ptr fs:[00000030h] 14_2_011B52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011B52A5 mov eax, dword ptr fs:[00000030h] 14_2_011B52A5
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E36CC mov eax, dword ptr fs:[00000030h] 14_2_011E36CC
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2ACB mov eax, dword ptr fs:[00000030h] 14_2_011E2ACB
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F8EC7 mov eax, dword ptr fs:[00000030h] 14_2_011F8EC7
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_0126FEC0 mov eax, dword ptr fs:[00000030h] 14_2_0126FEC0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E2AE4 mov eax, dword ptr fs:[00000030h] 14_2_011E2AE4
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011E16E0 mov ecx, dword ptr fs:[00000030h] 14_2_011E16E0
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_01288ED6 mov eax, dword ptr fs:[00000030h] 14_2_01288ED6
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011C76E2 mov eax, dword ptr fs:[00000030h] 14_2_011C76E2
Checks if the current process is being debugged
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Code function: 14_2_011F9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 14_2_011F9910
Source: C:\Users\user\Desktop\FT - 08082022.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Maps a DLL or memory area into another process
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Thread register set: target process: 3616 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\FT - 08082022.exe Process created: C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe Jump to behavior
Source: explorer.exe, 0000000F.00000000.464889138.0000000005610000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 0000000F.00000000.456251373.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.464901492.0000000005E60000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000F.00000000.456251373.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.353721308.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.492071081.00000000005C8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000F.00000000.456251373.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.353721308.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.428592787.0000000000B50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager,
Source: explorer.exe, 0000000F.00000000.456251373.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.353721308.0000000000B50000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 0000000F.00000000.428592787.0000000000B50000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\FT - 08082022.exe Queries volume information: C:\Users\user\Desktop\FT - 08082022.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FT - 08082022.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 14.0.InstallUtil.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.354778776.0000000003E79000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.471439159.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000000.445698170.000000000D40C000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.353706396.0000000003DDE000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000000.336455722.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 680396 Sample: FT - 08082022.exe Startdate: 08/08/2022 Architecture: WINDOWS Score: 100 17 Malicious sample detected (through community Yara rule) 2->17 19 Antivirus / Scanner detection for submitted sample 2->19 21 Yara detected FormBook 2->21 23 5 other signatures 2->23 7 FT - 08082022.exe 3 2->7         started        process3 file4 15 C:\Users\user\...\FT - 08082022.exe.log, ASCII 7->15 dropped 10 InstallUtil.exe 7->10         started        process5 signatures6 25 Modifies the context of a thread in another process (thread injection) 10->25 27 Maps a DLL or memory area into another process 10->27 29 Tries to detect virtualization through RDTSC time measurements 10->29 31 Queues an APC in another process (thread injection) 10->31 13 explorer.exe 10->13 injected process7
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.mcphiecabinetry.site/iw01/ true
  • Avira URL Cloud: safe
 low