Windows Analysis Report
SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe

Overview

General Information

Sample Name: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Analysis ID: 755946
MD5: 7b6dcd6fcd1c26b9abdba167929f4c82
SHA1: 04f11f07ef4a51b16383b5dde94f1af405893b45
SHA256: e38f6fab27253171688423b0792d38be81e4c01cceb35c7bca05d2ebfc011ae9
Tags: exe
Infos:

Detection

FormBook
Score: 92
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Machine Learning detection for sample
Injects a PE file into a foreign processes
Tries to detect virtualization through RDTSC time measurements
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe ReversingLabs: Detection: 41%
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Virustotal: Detection: 45% Perma Link
Yara detected FormBook
Source: Yara match File source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.imperiumtowns.xyz/b3es/"], "decoy": ["sweets.wtf", "apextama.com", "tygbs.com", "kumaoedu.com", "bestbathroomremodeling.club", "lnshykj.com", "nelsonanddima.com", "falunap.info", "codyhinrichs.com", "2797vip.com", "danutka.com", "3o2t307a.com", "kellymariewest.com", "profilelonn.online", "procan.website", "sopjimmy.com", "xn--skdarkae-55ac80i.net", "entitymanaged.com", "melitadahl.art", "joineguru.net", "good-meme.com", "creditconepts.com", "narafconstruction.com", "paspsichologa.com", "rancho365.com", "rimplefeel.com", "kingsub.online", "cnsrdns.com", "billythepainter.com", "clientevirtualpdf.net", "marycruzruiz.com", "renaultcikmaparca.xyz", "1600156.com", "paymallmart.info", "garafe.com", "fredrikk.net", "gogo-tunisia.space", "center-me.com", "xiaohuayhq.com", "xn--h49a60xt7azzcm91a.com", "unidiliobobo.info", "libertypolestore.com", "20111210.net", "atraofix.online", "furniron.com", "mingyun58.com", "shfesmua.com", "rdougdigital.life", "safsip.com", "melon.town", "sagihigaibengo.net", "ethnicsbyak.com", "designoffaitheventsllc.com", "dpmforensics.com", "ripple-us.net", "fuyouhin-happiness.com", "conceptweb.online", "l453.net", "zenars.com", "mepcoonlinebill.com", "oonn99.xyz", "dackus.energy", "articvas.com", "yayuanlin.com"]}
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.imperiumtowns.xyz/b3es/
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248951472.0000000006016000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249535557.0000000006017000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249659691.000000000601C000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249765760.000000000601C000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comB.TTF1
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comF1
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.coma
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250551871.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comals
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comce
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comessed
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comi
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.258838031.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comicom
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comitue
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250339759.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comoitu
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250428092.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comt
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247878242.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.cm
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247855685.000000000601A000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247400149.000000000602B000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.247855685.000000000601A000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/-e
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.250848136.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htmX
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/#
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/F
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Kal1
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/M
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/Y0/i
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/b
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/jp/
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/or1
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/siv
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249668471.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249560073.0000000006028000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.248773244.0000000006015000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249774268.0000000006022000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000003.249059141.0000000006028000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/vno
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266638604.0000000006027000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.monotype.
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.266762478.0000000007222000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5572, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Uses 32bit PE files
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5572, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 0_2_015FC334 0_2_015FC334
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 0_2_015FE790 0_2_015FE790
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 0_2_015FE78A 0_2_015FE78A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102F900 1_2_0102F900
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01044120 1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01042990 1_2_01042990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103C1C0 1_2_0103C1C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01026800 1_2_01026800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1002 1_2_010E1002
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105701D 1_2_0105701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010FE824 1_2_010FE824
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A830 1_2_0104A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103B090 1_2_0103B090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010520A0 1_2_010520A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F20A8 1_2_010F20A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F28EC 1_2_010F28EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E60F5 1_2_010E60F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E231B 1_2_010E231B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F2B28 1_2_010F2B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010CCB4F 1_2_010CCB4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104AB40 1_2_0104AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01043360 1_2_01043360
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010CEB8A 1_2_010CEB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105138B 1_2_0105138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104EB9A 1_2_0104EB9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105EBB0 1_2_0105EBB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E03DA 1_2_010E03DA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EDBD2 1_2_010EDBD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105ABD8 1_2_0105ABD8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010D23E3 1_2_010D23E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01078BE8 1_2_01078BE8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010DFA2B 1_2_010DFA2B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B236 1_2_0104B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E5A4F 1_2_010E5A4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F22AE 1_2_010F22AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F32A9 1_2_010F32A9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EE2C5 1_2_010EE2C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F2D07 1_2_010F2D07
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01020D20 1_2_01020D20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01042D50 1_2_01042D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F1D55 1_2_010F1D55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052581 1_2_01052581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2D82 1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010565A0 1_2_010565A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F25DD 1_2_010F25DD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103D5E0 1_2_0103D5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103841F 1_2_0103841F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01042430 1_2_01042430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010ED466 1_2_010ED466
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B477 1_2_0104B477
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010ECC77 1_2_010ECC77
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4496 1_2_010E4496
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054CD4 1_2_01054CD4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010FDFCE 1_2_010FDFCE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E67E2 1_2_010E67E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F1FF1 1_2_010F1FF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01045600 1_2_01045600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010ED616 1_2_010ED616
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01046E30 1_2_01046E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010AAE60 1_2_010AAE60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010D1EB6 1_2_010D1EB6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010506C0 1_2_010506C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F2EF7 1_2_010F2EF7
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: String function: 0102B150 appears 177 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: String function: 010B5720 appears 85 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: String function: 0107D08C appears 48 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_01069860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_01069660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010696E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_010696E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069910 NtAdjustPrivilegesToken, 1_2_01069910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069950 NtQueueApcThread, 1_2_01069950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010699A0 NtCreateSection, 1_2_010699A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010699D0 NtCreateProcessEx, 1_2_010699D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069820 NtEnumerateKey, 1_2_01069820
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069840 NtDelayExecution, 1_2_01069840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0106B040 NtSuspendThread, 1_2_0106B040
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010698A0 NtWriteVirtualMemory, 1_2_010698A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010698F0 NtReadVirtualMemory, 1_2_010698F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069B00 NtSetValueKey, 1_2_01069B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0106A3B0 NtGetContextThread, 1_2_0106A3B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069A00 NtProtectVirtualMemory, 1_2_01069A00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069A10 NtQuerySection, 1_2_01069A10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069A20 NtResumeThread, 1_2_01069A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069A50 NtCreateFile, 1_2_01069A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069A80 NtOpenDirectoryObject, 1_2_01069A80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069520 NtWaitForSingleObject, 1_2_01069520
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0106AD30 NtSetContextThread, 1_2_0106AD30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069540 NtReadFile, 1_2_01069540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069560 NtWriteFile, 1_2_01069560
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010695D0 NtClose, 1_2_010695D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010695F0 NtQueryInformationFile, 1_2_010695F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0106A710 NtOpenProcessToken, 1_2_0106A710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069710 NtQueryInformationToken, 1_2_01069710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069730 NtQueryVirtualMemory, 1_2_01069730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069760 NtOpenProcess, 1_2_01069760
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0106A770 NtOpenThread, 1_2_0106A770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069770 NtSetInformationFile, 1_2_01069770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069780 NtMapViewOfSection, 1_2_01069780
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010697A0 NtUnmapViewOfSection, 1_2_010697A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069FE0 NtCreateMutant, 1_2_01069FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069610 NtEnumerateValueKey, 1_2_01069610
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069650 NtQueryValueKey, 1_2_01069650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069670 NtQueryInformationProcess, 1_2_01069670
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010696D0 NtCreateKey, 1_2_010696D0
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.267730037.00000000078D0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCollins.dll8 vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260335497.0000000003001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePrecision.dll6 vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260335497.0000000003001000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameInspector.dllN vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.264250960.000000000111F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.261495799.0000000000F7E000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.259043934.0000000000DD5000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Binary or memory string: OriginalFilenamefzynaa.exe< vs SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe ReversingLabs: Detection: 41%
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Virustotal: Detection: 45%
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.log Jump to behavior
Source: classification engine Classification label: mal92.troj.evad.winEXE@3/1@0/0
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Mutant created: \Sessions\1\BaseNamedObjects\wGtrYQj
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.257989308.0000000000CBF000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000003.260648591.0000000000E5F000.00000004.00000800.00020000.00000000.sdmp, SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000001.00000002.262649793.0000000001000000.00000040.00000800.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0107D0D1 push ecx; ret 1_2_0107D0E4
Binary contains a suspicious time stamp
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Static PE information: 0xBF0A3116 [Sun Jul 26 06:03:02 2071 UTC]
Source: initial sample Static PE information: section name: .text entropy: 7.830178117653337
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe PID: 5448, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: SBIEDLL.DLL
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5464 Thread sleep time: -38122s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5468 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe TID: 5576 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01056B90 rdtsc 1_2_01056B90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe API coverage: 0.5 %
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Thread delayed: delay time: 38122 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: vmware
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMware SVGA II
Source: SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe, 00000000.00000002.260745770.0000000003051000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01056B90 rdtsc 1_2_01056B90
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01029100 mov eax, dword ptr fs:[00000030h] 1_2_01029100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01029100 mov eax, dword ptr fs:[00000030h] 1_2_01029100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01029100 mov eax, dword ptr fs:[00000030h] 1_2_01029100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01030100 mov eax, dword ptr fs:[00000030h] 1_2_01030100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01030100 mov eax, dword ptr fs:[00000030h] 1_2_01030100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01030100 mov eax, dword ptr fs:[00000030h] 1_2_01030100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01044120 mov eax, dword ptr fs:[00000030h] 1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01044120 mov eax, dword ptr fs:[00000030h] 1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01044120 mov eax, dword ptr fs:[00000030h] 1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01044120 mov eax, dword ptr fs:[00000030h] 1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01044120 mov ecx, dword ptr fs:[00000030h] 1_2_01044120
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01023138 mov ecx, dword ptr fs:[00000030h] 1_2_01023138
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105513A mov eax, dword ptr fs:[00000030h] 1_2_0105513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105513A mov eax, dword ptr fs:[00000030h] 1_2_0105513A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B944 mov eax, dword ptr fs:[00000030h] 1_2_0104B944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B944 mov eax, dword ptr fs:[00000030h] 1_2_0104B944
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102395E mov eax, dword ptr fs:[00000030h] 1_2_0102395E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102395E mov eax, dword ptr fs:[00000030h] 1_2_0102395E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1951 mov eax, dword ptr fs:[00000030h] 1_2_010E1951
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102C962 mov eax, dword ptr fs:[00000030h] 1_2_0102C962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F8966 mov eax, dword ptr fs:[00000030h] 1_2_010F8966
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EE962 mov eax, dword ptr fs:[00000030h] 1_2_010EE962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102B171 mov eax, dword ptr fs:[00000030h] 1_2_0102B171
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102B171 mov eax, dword ptr fs:[00000030h] 1_2_0102B171
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105A185 mov eax, dword ptr fs:[00000030h] 1_2_0105A185
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104C182 mov eax, dword ptr fs:[00000030h] 1_2_0104C182
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EA189 mov eax, dword ptr fs:[00000030h] 1_2_010EA189
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EA189 mov ecx, dword ptr fs:[00000030h] 1_2_010EA189
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01028190 mov ecx, dword ptr fs:[00000030h] 1_2_01028190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052990 mov eax, dword ptr fs:[00000030h] 1_2_01052990
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054190 mov eax, dword ptr fs:[00000030h] 1_2_01054190
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102519E mov eax, dword ptr fs:[00000030h] 1_2_0102519E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102519E mov ecx, dword ptr fs:[00000030h] 1_2_0102519E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010361A7 mov eax, dword ptr fs:[00000030h] 1_2_010361A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010361A7 mov eax, dword ptr fs:[00000030h] 1_2_010361A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010361A7 mov eax, dword ptr fs:[00000030h] 1_2_010361A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010361A7 mov eax, dword ptr fs:[00000030h] 1_2_010361A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010561A0 mov eax, dword ptr fs:[00000030h] 1_2_010561A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010561A0 mov eax, dword ptr fs:[00000030h] 1_2_010561A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E49A4 mov eax, dword ptr fs:[00000030h] 1_2_010E49A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E49A4 mov eax, dword ptr fs:[00000030h] 1_2_010E49A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E49A4 mov eax, dword ptr fs:[00000030h] 1_2_010E49A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E49A4 mov eax, dword ptr fs:[00000030h] 1_2_010E49A4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A69A6 mov eax, dword ptr fs:[00000030h] 1_2_010A69A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A51BE mov eax, dword ptr fs:[00000030h] 1_2_010A51BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A51BE mov eax, dword ptr fs:[00000030h] 1_2_010A51BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A51BE mov eax, dword ptr fs:[00000030h] 1_2_010A51BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A51BE mov eax, dword ptr fs:[00000030h] 1_2_010A51BE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010599BC mov eax, dword ptr fs:[00000030h] 1_2_010599BC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105C9BF mov eax, dword ptr fs:[00000030h] 1_2_0105C9BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105C9BF mov eax, dword ptr fs:[00000030h] 1_2_0105C9BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010FF1B5 mov eax, dword ptr fs:[00000030h] 1_2_010FF1B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010FF1B5 mov eax, dword ptr fs:[00000030h] 1_2_010FF1B5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov ecx, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov ecx, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov eax, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov ecx, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov ecx, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov eax, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov ecx, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov ecx, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov eax, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov ecx, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov ecx, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010499BF mov eax, dword ptr fs:[00000030h] 1_2_010499BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103C1C0 mov eax, dword ptr fs:[00000030h] 1_2_0103C1C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010399C7 mov eax, dword ptr fs:[00000030h] 1_2_010399C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010399C7 mov eax, dword ptr fs:[00000030h] 1_2_010399C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010399C7 mov eax, dword ptr fs:[00000030h] 1_2_010399C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010399C7 mov eax, dword ptr fs:[00000030h] 1_2_010399C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov ecx, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov ecx, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E31DC mov eax, dword ptr fs:[00000030h] 1_2_010E31DC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E19D8 mov eax, dword ptr fs:[00000030h] 1_2_010E19D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010231E0 mov eax, dword ptr fs:[00000030h] 1_2_010231E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010B41E8 mov eax, dword ptr fs:[00000030h] 1_2_010B41E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102B1E1 mov eax, dword ptr fs:[00000030h] 1_2_0102B1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102B1E1 mov eax, dword ptr fs:[00000030h] 1_2_0102B1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102B1E1 mov eax, dword ptr fs:[00000030h] 1_2_0102B1E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F89E7 mov eax, dword ptr fs:[00000030h] 1_2_010F89E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104D1EF mov eax, dword ptr fs:[00000030h] 1_2_0104D1EF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01026800 mov eax, dword ptr fs:[00000030h] 1_2_01026800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01026800 mov eax, dword ptr fs:[00000030h] 1_2_01026800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01026800 mov eax, dword ptr fs:[00000030h] 1_2_01026800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105701D mov eax, dword ptr fs:[00000030h] 1_2_0105701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105701D mov eax, dword ptr fs:[00000030h] 1_2_0105701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105701D mov eax, dword ptr fs:[00000030h] 1_2_0105701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105701D mov eax, dword ptr fs:[00000030h] 1_2_0105701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105701D mov eax, dword ptr fs:[00000030h] 1_2_0105701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105701D mov eax, dword ptr fs:[00000030h] 1_2_0105701D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F4015 mov eax, dword ptr fs:[00000030h] 1_2_010F4015
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F4015 mov eax, dword ptr fs:[00000030h] 1_2_010F4015
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A7016 mov eax, dword ptr fs:[00000030h] 1_2_010A7016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A7016 mov eax, dword ptr fs:[00000030h] 1_2_010A7016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A7016 mov eax, dword ptr fs:[00000030h] 1_2_010A7016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054020 mov edi, dword ptr fs:[00000030h] 1_2_01054020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105002D mov eax, dword ptr fs:[00000030h] 1_2_0105002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105002D mov eax, dword ptr fs:[00000030h] 1_2_0105002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105002D mov eax, dword ptr fs:[00000030h] 1_2_0105002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105002D mov eax, dword ptr fs:[00000030h] 1_2_0105002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105002D mov eax, dword ptr fs:[00000030h] 1_2_0105002D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103B02A mov eax, dword ptr fs:[00000030h] 1_2_0103B02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103B02A mov eax, dword ptr fs:[00000030h] 1_2_0103B02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103B02A mov eax, dword ptr fs:[00000030h] 1_2_0103B02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103B02A mov eax, dword ptr fs:[00000030h] 1_2_0103B02A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A830 mov eax, dword ptr fs:[00000030h] 1_2_0104A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A830 mov eax, dword ptr fs:[00000030h] 1_2_0104A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A830 mov eax, dword ptr fs:[00000030h] 1_2_0104A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A830 mov eax, dword ptr fs:[00000030h] 1_2_0104A830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1843 mov eax, dword ptr fs:[00000030h] 1_2_010E1843
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025050 mov eax, dword ptr fs:[00000030h] 1_2_01025050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025050 mov eax, dword ptr fs:[00000030h] 1_2_01025050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025050 mov eax, dword ptr fs:[00000030h] 1_2_01025050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01040050 mov eax, dword ptr fs:[00000030h] 1_2_01040050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01040050 mov eax, dword ptr fs:[00000030h] 1_2_01040050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01027057 mov eax, dword ptr fs:[00000030h] 1_2_01027057
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104F86D mov eax, dword ptr fs:[00000030h] 1_2_0104F86D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F1074 mov eax, dword ptr fs:[00000030h] 1_2_010F1074
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2073 mov eax, dword ptr fs:[00000030h] 1_2_010E2073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01029080 mov eax, dword ptr fs:[00000030h] 1_2_01029080
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01023880 mov eax, dword ptr fs:[00000030h] 1_2_01023880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01023880 mov eax, dword ptr fs:[00000030h] 1_2_01023880
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A3884 mov eax, dword ptr fs:[00000030h] 1_2_010A3884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A3884 mov eax, dword ptr fs:[00000030h] 1_2_010A3884
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010520A0 mov eax, dword ptr fs:[00000030h] 1_2_010520A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010520A0 mov eax, dword ptr fs:[00000030h] 1_2_010520A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010520A0 mov eax, dword ptr fs:[00000030h] 1_2_010520A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010520A0 mov eax, dword ptr fs:[00000030h] 1_2_010520A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010520A0 mov eax, dword ptr fs:[00000030h] 1_2_010520A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010520A0 mov eax, dword ptr fs:[00000030h] 1_2_010520A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010578A0 mov eax, dword ptr fs:[00000030h] 1_2_010578A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010690AF mov eax, dword ptr fs:[00000030h] 1_2_010690AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328AE mov eax, dword ptr fs:[00000030h] 1_2_010328AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328AE mov eax, dword ptr fs:[00000030h] 1_2_010328AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328AE mov eax, dword ptr fs:[00000030h] 1_2_010328AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328AE mov ecx, dword ptr fs:[00000030h] 1_2_010328AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328AE mov eax, dword ptr fs:[00000030h] 1_2_010328AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328AE mov eax, dword ptr fs:[00000030h] 1_2_010328AE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105F0BF mov ecx, dword ptr fs:[00000030h] 1_2_0105F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105F0BF mov eax, dword ptr fs:[00000030h] 1_2_0105F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105F0BF mov eax, dword ptr fs:[00000030h] 1_2_0105F0BF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010270C0 mov eax, dword ptr fs:[00000030h] 1_2_010270C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010270C0 mov eax, dword ptr fs:[00000030h] 1_2_010270C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E18CA mov eax, dword ptr fs:[00000030h] 1_2_010E18CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB0C7 mov eax, dword ptr fs:[00000030h] 1_2_010EB0C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB0C7 mov eax, dword ptr fs:[00000030h] 1_2_010EB0C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010278D6 mov eax, dword ptr fs:[00000030h] 1_2_010278D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010278D6 mov eax, dword ptr fs:[00000030h] 1_2_010278D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010278D6 mov ecx, dword ptr fs:[00000030h] 1_2_010278D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_010BB8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010BB8D0 mov ecx, dword ptr fs:[00000030h] 1_2_010BB8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_010BB8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_010BB8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_010BB8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010BB8D0 mov eax, dword ptr fs:[00000030h] 1_2_010BB8D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B8E4 mov eax, dword ptr fs:[00000030h] 1_2_0104B8E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B8E4 mov eax, dword ptr fs:[00000030h] 1_2_0104B8E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010240E1 mov eax, dword ptr fs:[00000030h] 1_2_010240E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010240E1 mov eax, dword ptr fs:[00000030h] 1_2_010240E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010240E1 mov eax, dword ptr fs:[00000030h] 1_2_010240E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010258EC mov eax, dword ptr fs:[00000030h] 1_2_010258EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E60F5 mov eax, dword ptr fs:[00000030h] 1_2_010E60F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E60F5 mov eax, dword ptr fs:[00000030h] 1_2_010E60F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E60F5 mov eax, dword ptr fs:[00000030h] 1_2_010E60F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E60F5 mov eax, dword ptr fs:[00000030h] 1_2_010E60F5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328FD mov eax, dword ptr fs:[00000030h] 1_2_010328FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328FD mov eax, dword ptr fs:[00000030h] 1_2_010328FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010328FD mov eax, dword ptr fs:[00000030h] 1_2_010328FD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A309 mov eax, dword ptr fs:[00000030h] 1_2_0104A309
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E131B mov eax, dword ptr fs:[00000030h] 1_2_010E131B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102DB40 mov eax, dword ptr fs:[00000030h] 1_2_0102DB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F8B58 mov eax, dword ptr fs:[00000030h] 1_2_010F8B58
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102F358 mov eax, dword ptr fs:[00000030h] 1_2_0102F358
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01053B5A mov eax, dword ptr fs:[00000030h] 1_2_01053B5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01053B5A mov eax, dword ptr fs:[00000030h] 1_2_01053B5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01053B5A mov eax, dword ptr fs:[00000030h] 1_2_01053B5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01053B5A mov eax, dword ptr fs:[00000030h] 1_2_01053B5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102DB60 mov ecx, dword ptr fs:[00000030h] 1_2_0102DB60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010B6365 mov eax, dword ptr fs:[00000030h] 1_2_010B6365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010B6365 mov eax, dword ptr fs:[00000030h] 1_2_010B6365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010B6365 mov eax, dword ptr fs:[00000030h] 1_2_010B6365
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01027B70 mov eax, dword ptr fs:[00000030h] 1_2_01027B70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103F370 mov eax, dword ptr fs:[00000030h] 1_2_0103F370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103F370 mov eax, dword ptr fs:[00000030h] 1_2_0103F370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103F370 mov eax, dword ptr fs:[00000030h] 1_2_0103F370
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01053B7A mov eax, dword ptr fs:[00000030h] 1_2_01053B7A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01053B7A mov eax, dword ptr fs:[00000030h] 1_2_01053B7A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E138A mov eax, dword ptr fs:[00000030h] 1_2_010E138A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010CEB8A mov ecx, dword ptr fs:[00000030h] 1_2_010CEB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010CEB8A mov eax, dword ptr fs:[00000030h] 1_2_010CEB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010CEB8A mov eax, dword ptr fs:[00000030h] 1_2_010CEB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010CEB8A mov eax, dword ptr fs:[00000030h] 1_2_010CEB8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01031B8F mov eax, dword ptr fs:[00000030h] 1_2_01031B8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01031B8F mov eax, dword ptr fs:[00000030h] 1_2_01031B8F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010DD380 mov ecx, dword ptr fs:[00000030h] 1_2_010DD380
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105138B mov eax, dword ptr fs:[00000030h] 1_2_0105138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105138B mov eax, dword ptr fs:[00000030h] 1_2_0105138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105138B mov eax, dword ptr fs:[00000030h] 1_2_0105138B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052397 mov eax, dword ptr fs:[00000030h] 1_2_01052397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105B390 mov eax, dword ptr fs:[00000030h] 1_2_0105B390
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01024B94 mov edi, dword ptr fs:[00000030h] 1_2_01024B94
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104EB9A mov eax, dword ptr fs:[00000030h] 1_2_0104EB9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104EB9A mov eax, dword ptr fs:[00000030h] 1_2_0104EB9A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1BA8 mov eax, dword ptr fs:[00000030h] 1_2_010E1BA8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054BAD mov eax, dword ptr fs:[00000030h] 1_2_01054BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054BAD mov eax, dword ptr fs:[00000030h] 1_2_01054BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054BAD mov eax, dword ptr fs:[00000030h] 1_2_01054BAD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F5BA5 mov eax, dword ptr fs:[00000030h] 1_2_010F5BA5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F9BBE mov eax, dword ptr fs:[00000030h] 1_2_010F9BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F8BB6 mov eax, dword ptr fs:[00000030h] 1_2_010F8BB6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A53CA mov eax, dword ptr fs:[00000030h] 1_2_010A53CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A53CA mov eax, dword ptr fs:[00000030h] 1_2_010A53CA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010553C5 mov eax, dword ptr fs:[00000030h] 1_2_010553C5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010503E2 mov eax, dword ptr fs:[00000030h] 1_2_010503E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010503E2 mov eax, dword ptr fs:[00000030h] 1_2_010503E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010503E2 mov eax, dword ptr fs:[00000030h] 1_2_010503E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010503E2 mov eax, dword ptr fs:[00000030h] 1_2_010503E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010503E2 mov eax, dword ptr fs:[00000030h] 1_2_010503E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010503E2 mov eax, dword ptr fs:[00000030h] 1_2_010503E2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01021BE9 mov eax, dword ptr fs:[00000030h] 1_2_01021BE9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104DBE9 mov eax, dword ptr fs:[00000030h] 1_2_0104DBE9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010D23E3 mov ecx, dword ptr fs:[00000030h] 1_2_010D23E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010D23E3 mov ecx, dword ptr fs:[00000030h] 1_2_010D23E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010D23E3 mov eax, dword ptr fs:[00000030h] 1_2_010D23E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov ecx, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103BA00 mov eax, dword ptr fs:[00000030h] 1_2_0103BA00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01038A0A mov eax, dword ptr fs:[00000030h] 1_2_01038A0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025210 mov eax, dword ptr fs:[00000030h] 1_2_01025210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025210 mov ecx, dword ptr fs:[00000030h] 1_2_01025210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025210 mov eax, dword ptr fs:[00000030h] 1_2_01025210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025210 mov eax, dword ptr fs:[00000030h] 1_2_01025210
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102AA16 mov eax, dword ptr fs:[00000030h] 1_2_0102AA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102AA16 mov eax, dword ptr fs:[00000030h] 1_2_0102AA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01043A1C mov eax, dword ptr fs:[00000030h] 1_2_01043A1C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EAA16 mov eax, dword ptr fs:[00000030h] 1_2_010EAA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EAA16 mov eax, dword ptr fs:[00000030h] 1_2_010EAA16
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01024A20 mov eax, dword ptr fs:[00000030h] 1_2_01024A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01024A20 mov eax, dword ptr fs:[00000030h] 1_2_01024A20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1229 mov eax, dword ptr fs:[00000030h] 1_2_010E1229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01064A2C mov eax, dword ptr fs:[00000030h] 1_2_01064A2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01064A2C mov eax, dword ptr fs:[00000030h] 1_2_01064A2C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104A229 mov eax, dword ptr fs:[00000030h] 1_2_0104A229
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B236 mov eax, dword ptr fs:[00000030h] 1_2_0104B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B236 mov eax, dword ptr fs:[00000030h] 1_2_0104B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B236 mov eax, dword ptr fs:[00000030h] 1_2_0104B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B236 mov eax, dword ptr fs:[00000030h] 1_2_0104B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B236 mov eax, dword ptr fs:[00000030h] 1_2_0104B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104B236 mov eax, dword ptr fs:[00000030h] 1_2_0104B236
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01028239 mov eax, dword ptr fs:[00000030h] 1_2_01028239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01028239 mov eax, dword ptr fs:[00000030h] 1_2_01028239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01028239 mov eax, dword ptr fs:[00000030h] 1_2_01028239
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E5A4F mov eax, dword ptr fs:[00000030h] 1_2_010E5A4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E5A4F mov eax, dword ptr fs:[00000030h] 1_2_010E5A4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E5A4F mov eax, dword ptr fs:[00000030h] 1_2_010E5A4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E5A4F mov eax, dword ptr fs:[00000030h] 1_2_010E5A4F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01029240 mov eax, dword ptr fs:[00000030h] 1_2_01029240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01029240 mov eax, dword ptr fs:[00000030h] 1_2_01029240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01029240 mov eax, dword ptr fs:[00000030h] 1_2_01029240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01029240 mov eax, dword ptr fs:[00000030h] 1_2_01029240
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1A5F mov eax, dword ptr fs:[00000030h] 1_2_010E1A5F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EEA55 mov eax, dword ptr fs:[00000030h] 1_2_010EEA55
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010B4257 mov eax, dword ptr fs:[00000030h] 1_2_010B4257
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010DB260 mov eax, dword ptr fs:[00000030h] 1_2_010DB260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010DB260 mov eax, dword ptr fs:[00000030h] 1_2_010DB260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F8A62 mov eax, dword ptr fs:[00000030h] 1_2_010F8A62
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01065A69 mov eax, dword ptr fs:[00000030h] 1_2_01065A69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01065A69 mov eax, dword ptr fs:[00000030h] 1_2_01065A69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01065A69 mov eax, dword ptr fs:[00000030h] 1_2_01065A69
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0106927A mov eax, dword ptr fs:[00000030h] 1_2_0106927A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105DA88 mov eax, dword ptr fs:[00000030h] 1_2_0105DA88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105DA88 mov eax, dword ptr fs:[00000030h] 1_2_0105DA88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105D294 mov eax, dword ptr fs:[00000030h] 1_2_0105D294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105D294 mov eax, dword ptr fs:[00000030h] 1_2_0105D294
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E129A mov eax, dword ptr fs:[00000030h] 1_2_010E129A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01021AA0 mov eax, dword ptr fs:[00000030h] 1_2_01021AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010362A0 mov eax, dword ptr fs:[00000030h] 1_2_010362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010362A0 mov eax, dword ptr fs:[00000030h] 1_2_010362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010362A0 mov eax, dword ptr fs:[00000030h] 1_2_010362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010362A0 mov eax, dword ptr fs:[00000030h] 1_2_010362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01055AA0 mov eax, dword ptr fs:[00000030h] 1_2_01055AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01055AA0 mov eax, dword ptr fs:[00000030h] 1_2_01055AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010252A5 mov eax, dword ptr fs:[00000030h] 1_2_010252A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010252A5 mov eax, dword ptr fs:[00000030h] 1_2_010252A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010252A5 mov eax, dword ptr fs:[00000030h] 1_2_010252A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010252A5 mov eax, dword ptr fs:[00000030h] 1_2_010252A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010252A5 mov eax, dword ptr fs:[00000030h] 1_2_010252A5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103AAB0 mov eax, dword ptr fs:[00000030h] 1_2_0103AAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103AAB0 mov eax, dword ptr fs:[00000030h] 1_2_0103AAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105FAB0 mov eax, dword ptr fs:[00000030h] 1_2_0105FAB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010512BD mov esi, dword ptr fs:[00000030h] 1_2_010512BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010512BD mov eax, dword ptr fs:[00000030h] 1_2_010512BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010512BD mov eax, dword ptr fs:[00000030h] 1_2_010512BD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025AC0 mov eax, dword ptr fs:[00000030h] 1_2_01025AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025AC0 mov eax, dword ptr fs:[00000030h] 1_2_01025AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01025AC0 mov eax, dword ptr fs:[00000030h] 1_2_01025AC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01023ACA mov eax, dword ptr fs:[00000030h] 1_2_01023ACA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052ACB mov eax, dword ptr fs:[00000030h] 1_2_01052ACB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F8ADD mov eax, dword ptr fs:[00000030h] 1_2_010F8ADD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010212D4 mov eax, dword ptr fs:[00000030h] 1_2_010212D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052AE4 mov eax, dword ptr fs:[00000030h] 1_2_01052AE4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E4AEF mov eax, dword ptr fs:[00000030h] 1_2_010E4AEF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB2E8 mov eax, dword ptr fs:[00000030h] 1_2_010EB2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB2E8 mov eax, dword ptr fs:[00000030h] 1_2_010EB2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB2E8 mov eax, dword ptr fs:[00000030h] 1_2_010EB2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB2E8 mov eax, dword ptr fs:[00000030h] 1_2_010EB2E8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010CCD04 mov eax, dword ptr fs:[00000030h] 1_2_010CCD04
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E3518 mov eax, dword ptr fs:[00000030h] 1_2_010E3518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E3518 mov eax, dword ptr fs:[00000030h] 1_2_010E3518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E3518 mov eax, dword ptr fs:[00000030h] 1_2_010E3518
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102751A mov eax, dword ptr fs:[00000030h] 1_2_0102751A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102751A mov eax, dword ptr fs:[00000030h] 1_2_0102751A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102751A mov eax, dword ptr fs:[00000030h] 1_2_0102751A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102751A mov eax, dword ptr fs:[00000030h] 1_2_0102751A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105F527 mov eax, dword ptr fs:[00000030h] 1_2_0105F527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105F527 mov eax, dword ptr fs:[00000030h] 1_2_0105F527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105F527 mov eax, dword ptr fs:[00000030h] 1_2_0105F527
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102AD30 mov eax, dword ptr fs:[00000030h] 1_2_0102AD30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01033D34 mov eax, dword ptr fs:[00000030h] 1_2_01033D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EE539 mov eax, dword ptr fs:[00000030h] 1_2_010EE539
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F8D34 mov eax, dword ptr fs:[00000030h] 1_2_010F8D34
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010AA537 mov eax, dword ptr fs:[00000030h] 1_2_010AA537
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054D3B mov eax, dword ptr fs:[00000030h] 1_2_01054D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054D3B mov eax, dword ptr fs:[00000030h] 1_2_01054D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01054D3B mov eax, dword ptr fs:[00000030h] 1_2_01054D3B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01063D43 mov eax, dword ptr fs:[00000030h] 1_2_01063D43
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A3540 mov eax, dword ptr fs:[00000030h] 1_2_010A3540
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010D8D47 mov eax, dword ptr fs:[00000030h] 1_2_010D8D47
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010D3D40 mov eax, dword ptr fs:[00000030h] 1_2_010D3D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102354C mov eax, dword ptr fs:[00000030h] 1_2_0102354C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0102354C mov eax, dword ptr fs:[00000030h] 1_2_0102354C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01047D50 mov eax, dword ptr fs:[00000030h] 1_2_01047D50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01064D51 mov eax, dword ptr fs:[00000030h] 1_2_01064D51
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01064D51 mov eax, dword ptr fs:[00000030h] 1_2_01064D51
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010DFD52 mov eax, dword ptr fs:[00000030h] 1_2_010DFD52
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01048D76 mov eax, dword ptr fs:[00000030h] 1_2_01048D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01048D76 mov eax, dword ptr fs:[00000030h] 1_2_01048D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01048D76 mov eax, dword ptr fs:[00000030h] 1_2_01048D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01048D76 mov eax, dword ptr fs:[00000030h] 1_2_01048D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01048D76 mov eax, dword ptr fs:[00000030h] 1_2_01048D76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104C577 mov eax, dword ptr fs:[00000030h] 1_2_0104C577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0104C577 mov eax, dword ptr fs:[00000030h] 1_2_0104C577
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052581 mov eax, dword ptr fs:[00000030h] 1_2_01052581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052581 mov eax, dword ptr fs:[00000030h] 1_2_01052581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052581 mov eax, dword ptr fs:[00000030h] 1_2_01052581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01052581 mov eax, dword ptr fs:[00000030h] 1_2_01052581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01022D8A mov eax, dword ptr fs:[00000030h] 1_2_01022D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01022D8A mov eax, dword ptr fs:[00000030h] 1_2_01022D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01022D8A mov eax, dword ptr fs:[00000030h] 1_2_01022D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01022D8A mov eax, dword ptr fs:[00000030h] 1_2_01022D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01022D8A mov eax, dword ptr fs:[00000030h] 1_2_01022D8A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2D82 mov eax, dword ptr fs:[00000030h] 1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2D82 mov eax, dword ptr fs:[00000030h] 1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2D82 mov eax, dword ptr fs:[00000030h] 1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2D82 mov eax, dword ptr fs:[00000030h] 1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2D82 mov eax, dword ptr fs:[00000030h] 1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2D82 mov eax, dword ptr fs:[00000030h] 1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E2D82 mov eax, dword ptr fs:[00000030h] 1_2_010E2D82
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB581 mov eax, dword ptr fs:[00000030h] 1_2_010EB581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB581 mov eax, dword ptr fs:[00000030h] 1_2_010EB581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB581 mov eax, dword ptr fs:[00000030h] 1_2_010EB581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EB581 mov eax, dword ptr fs:[00000030h] 1_2_010EB581
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01023591 mov eax, dword ptr fs:[00000030h] 1_2_01023591
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105FD9B mov eax, dword ptr fs:[00000030h] 1_2_0105FD9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0105FD9B mov eax, dword ptr fs:[00000030h] 1_2_0105FD9B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F05AC mov eax, dword ptr fs:[00000030h] 1_2_010F05AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F05AC mov eax, dword ptr fs:[00000030h] 1_2_010F05AC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010535A1 mov eax, dword ptr fs:[00000030h] 1_2_010535A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010565A0 mov eax, dword ptr fs:[00000030h] 1_2_010565A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010565A0 mov eax, dword ptr fs:[00000030h] 1_2_010565A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010565A0 mov eax, dword ptr fs:[00000030h] 1_2_010565A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01051DB5 mov eax, dword ptr fs:[00000030h] 1_2_01051DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01051DB5 mov eax, dword ptr fs:[00000030h] 1_2_01051DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01051DB5 mov eax, dword ptr fs:[00000030h] 1_2_01051DB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_010A6DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_010A6DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_010A6DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6DC9 mov ecx, dword ptr fs:[00000030h] 1_2_010A6DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_010A6DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6DC9 mov eax, dword ptr fs:[00000030h] 1_2_010A6DC9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010215C1 mov eax, dword ptr fs:[00000030h] 1_2_010215C1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010DFDD3 mov eax, dword ptr fs:[00000030h] 1_2_010DFDD3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103D5E0 mov eax, dword ptr fs:[00000030h] 1_2_0103D5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_0103D5E0 mov eax, dword ptr fs:[00000030h] 1_2_0103D5E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010B3DE3 mov ecx, dword ptr fs:[00000030h] 1_2_010B3DE3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010B3DE3 mov eax, dword ptr fs:[00000030h] 1_2_010B3DE3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010B3DE3 mov eax, dword ptr fs:[00000030h] 1_2_010B3DE3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010595EC mov eax, dword ptr fs:[00000030h] 1_2_010595EC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EFDE2 mov eax, dword ptr fs:[00000030h] 1_2_010EFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EFDE2 mov eax, dword ptr fs:[00000030h] 1_2_010EFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EFDE2 mov eax, dword ptr fs:[00000030h] 1_2_010EFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010EFDE2 mov eax, dword ptr fs:[00000030h] 1_2_010EFDE2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010295F0 mov eax, dword ptr fs:[00000030h] 1_2_010295F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010295F0 mov ecx, dword ptr fs:[00000030h] 1_2_010295F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010D8DF1 mov eax, dword ptr fs:[00000030h] 1_2_010D8DF1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6C0A mov eax, dword ptr fs:[00000030h] 1_2_010A6C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6C0A mov eax, dword ptr fs:[00000030h] 1_2_010A6C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6C0A mov eax, dword ptr fs:[00000030h] 1_2_010A6C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010A6C0A mov eax, dword ptr fs:[00000030h] 1_2_010A6C0A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F740D mov eax, dword ptr fs:[00000030h] 1_2_010F740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F740D mov eax, dword ptr fs:[00000030h] 1_2_010F740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F740D mov eax, dword ptr fs:[00000030h] 1_2_010F740D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010E1C06 mov eax, dword ptr fs:[00000030h] 1_2_010E1C06
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01028410 mov eax, dword ptr fs:[00000030h] 1_2_01028410
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_010F8C14 mov eax, dword ptr fs:[00000030h] 1_2_010F8C14
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Code function: 1_2_01069860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_01069860
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 1.0.SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.265052163.0000000004196000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.257340997.0000000000401000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 755946 Sample: SecuriteInfo.com.Win32.PWSX... Startdate: 29/11/2022 Architecture: WINDOWS Score: 92 14 Malicious sample detected (through community Yara rule) 2->14 16 Multi AV Scanner detection for submitted file 2->16 18 Yara detected AntiVM3 2->18 20 4 other signatures 2->20 6 SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe 3 2->6         started        process3 file4 12 SecuriteInfo.com.W...27251.20675.exe.log, ASCII 6->12 dropped 22 Tries to detect virtualization through RDTSC time measurements 6->22 24 Injects a PE file into a foreign processes 6->24 10 SecuriteInfo.com.Win32.PWSX-gen.27251.20675.exe 6->10         started        signatures5 process6
⊘No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.imperiumtowns.xyz/b3es/ true
  • 1%, Virustotal, Browse
  • Avira URL Cloud: safe
 low