Windows Analysis Report
gsPzUI8EV8RoSMt.exe

Overview

General Information

Sample Name: gsPzUI8EV8RoSMt.exe
Analysis ID: 830457
MD5: bf7689cacf1c7ec05684d27628538b3d
SHA1: 9186ece8e710a0d849834538b711fe90cb830c71
SHA256: 85b572a6060bf6d434ab978aa1447096c11f84bcd329d71364de8daf261a4660
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: gsPzUI8EV8RoSMt.exe ReversingLabs: Detection: 25%
Source: gsPzUI8EV8RoSMt.exe Virustotal: Detection: 37% Perma Link
Yara detected FormBook
Source: Yara match File source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.ntiled.net/us38/ Avira URL Cloud: Label: malware
Source: http://www.qdtlmj.com/us38/?7n=ZVfFkidWioZ1z242CMU5NErFVagRqFscjwTZw32dpH9T5nOFHAt7D4fNn/kr4Wxh+xCU&5jJX=q8td9Nm Avira URL Cloud: Label: malware
Source: http://www.codshipin.com/us38/ Avira URL Cloud: Label: malware
Source: http://www.customgiveawaysplus.com/us38/ Avira URL Cloud: Label: malware
Source: http://www.fatherlandistanbul.com/us38/www.customgiveawaysplus.com Avira URL Cloud: Label: malware
Source: http://www.jggfj.com/us38/www.efefcorn.buzz Avira URL Cloud: Label: malware
Source: http://www.91ye260.xyz/us38/ Avira URL Cloud: Label: malware
Source: http://www.91ye260.xyz/us38/www.fatherlandistanbul.com Avira URL Cloud: Label: malware
Source: http://www.jggfj.com/us38/ Avira URL Cloud: Label: malware
Source: http://www.qdtlmj.com/us38/ Avira URL Cloud: Label: malware
Source: http://www.huntergatherer.store/us38/ Avira URL Cloud: Label: malware
Source: http://www.huntergatherer.store/us38/www.pickleontop.net Avira URL Cloud: Label: malware
Source: http://www.qdtlmj.com/us38/www.lightscript.ru Avira URL Cloud: Label: malware
Source: http://www.artificial-grass-61758.com/us38/ Avira URL Cloud: Label: malware
Source: http://www.efefcorn.buzz/us38/ Avira URL Cloud: Label: malware
Source: http://www.lightscript.ru/us38/ Avira URL Cloud: Label: malware
Source: http://www.codshipin.com/us38/www.bhukroofingandbuilding.co.uk Avira URL Cloud: Label: malware
Source: http://www.efefcorn.buzz/us38/www.huntergatherer.store Avira URL Cloud: Label: malware
Source: http://www.ntiled.net/us38/www.artificial-grass-61758.com Avira URL Cloud: Label: malware
Source: http://www.fatherlandistanbul.com/us38/ Avira URL Cloud: Label: malware
Source: http://www.lightscript.ru/us38/www.ntiled.net Avira URL Cloud: Label: malware
Source: http://www.mymof.uk/us38/ Avira URL Cloud: Label: malware
Source: http://www.customgiveawaysplus.com/us38/www.codshipin.com Avira URL Cloud: Label: malware
Source: http://www.artificial-grass-61758.com/us38/www.loxnorth.com Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: gsPzUI8EV8RoSMt.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.pickleontop.net/us38/"], "decoy": ["jimsminitours.com", "ezdineros.com", "imtokonapp.art", "54gsyekcpc.one", "triplemcatering.africa", "ntiled.net", "iniyan.click", "cyproducers.com", "instantrule.com", "visefastener.net", "lightscript.ru", "dyshuju.top", "jifenzhigl.com", "himselvepostly.xyz", "jggfj.com", "jbjiif.cfd", "gumpisbuel.ch", "gddeming.com", "huntergatherer.store", "kitchenremodelingtoday.com", "endssheiproduct.com", "installsolar.africa", "flexclark.com", "zerooverhead.net", "mymof.uk", "customgiveawaysplus.com", "qdtlmj.com", "beyouinvestnow.com", "dongyuesm.com", "bameit.xyz", "bhukroofingandbuilding.co.uk", "loxnorth.com", "calihon.com", "algeeml.com", "shedmastersukltd.co.uk", "cuidadores24h.com", "kinogo-cc.online", "onlinextools.net", "codshipin.com", "driver-response.com", "kaydrop.ru", "426664.space", "efefcorn.buzz", "artificial-grass-61758.com", "myhotplug.africa", "earlytechnews.com", "argana-bremen.com", "122874.com", "laposadaapts.com", "91ye260.xyz", "freewriter.online", "jainrishta.com", "jumptaskks.com", "cafeverde.xyz", "xppenetwork.net", "kcam-phnompenhcredit.com", "assinieconcept.com", "3651233.com", "homebodymindco.com", "andara88.info", "greatlakesyouth.com", "fatherlandistanbul.com", "sc-orikomi.com", "fx.foundation"]}
Uses 32bit PE files
Source: gsPzUI8EV8RoSMt.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: gsPzUI8EV8RoSMt.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: colorcpl.pdbGCTL source: gsPzUI8EV8RoSMt.exe, 00000001.00000002.418940890.0000000001E20000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: Roic.pdbSHA256 source: gsPzUI8EV8RoSMt.exe
Source: Binary string: colorcpl.pdb source: gsPzUI8EV8RoSMt.exe, 00000001.00000002.418940890.0000000001E20000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: gsPzUI8EV8RoSMt.exe, 00000001.00000003.368312531.0000000001801000.00000004.00000020.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000001.00000002.415316568.00000000019A0000.00000040.00001000.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000001.00000003.364658614.000000000166B000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.414988735.00000000040B8000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.584278555.000000000450F000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.584278555.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.417695049.0000000004254000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: gsPzUI8EV8RoSMt.exe, gsPzUI8EV8RoSMt.exe, 00000001.00000003.368312531.0000000001801000.00000004.00000020.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000001.00000002.415316568.00000000019A0000.00000040.00001000.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000001.00000003.364658614.000000000166B000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.414988735.00000000040B8000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.584278555.000000000450F000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.584278555.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.417695049.0000000004254000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Roic.pdb source: gsPzUI8EV8RoSMt.exe

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 194.50.194.150 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.qdtlmj.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.pickleontop.net/us38/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: QUICKPACKETUS QUICKPACKETUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /us38/?7n=ZVfFkidWioZ1z242CMU5NErFVagRqFscjwTZw32dpH9T5nOFHAt7D4fNn/kr4Wxh+xCU&5jJX=q8td9Nm HTTP/1.1Host: www.qdtlmj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000002.00000002.601106968.000000001593F000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000003.00000002.585071927.0000000004E0F000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.91ye260.xyz
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.91ye260.xyz/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.91ye260.xyz/us38/www.fatherlandistanbul.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.91ye260.xyzReferer:
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.artificial-grass-61758.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.artificial-grass-61758.com/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.artificial-grass-61758.com/us38/www.loxnorth.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.artificial-grass-61758.comReferer:
Source: explorer.exe, 00000002.00000002.598775114.000000000ED28000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED27000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.583649197.000000000091F000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000000.371135857.000000000091F000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bameit.xyz
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bameit.xyz/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bameit.xyz/us38/www.qdtlmj.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bameit.xyzReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bhukroofingandbuilding.co.uk
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bhukroofingandbuilding.co.uk/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bhukroofingandbuilding.co.uk/us38/www.mymof.uk
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bhukroofingandbuilding.co.ukReferer:
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.codshipin.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.codshipin.com/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.codshipin.com/us38/www.bhukroofingandbuilding.co.uk
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.codshipin.comReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.customgiveawaysplus.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.customgiveawaysplus.com/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.customgiveawaysplus.com/us38/www.codshipin.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.customgiveawaysplus.comReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.efefcorn.buzz
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.efefcorn.buzz/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.efefcorn.buzz/us38/www.huntergatherer.store
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.efefcorn.buzzReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fatherlandistanbul.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fatherlandistanbul.com/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fatherlandistanbul.com/us38/www.customgiveawaysplus.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.fatherlandistanbul.comReferer:
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000003.366148339.0000000006530000.00000004.00000020.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000003.366148339.0000000006530000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comgreta(
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000003.366148339.0000000006530000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.comm
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000003.366148339.0000000006530000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.fontbureau.commto
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.fonts.com
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000003.326136171.0000000006542000.00000004.00000020.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000000.00000003.325971120.0000000006542000.00000004.00000020.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000000.00000003.326349789.0000000006542000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.huntergatherer.store
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.huntergatherer.store/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.huntergatherer.store/us38/www.pickleontop.net
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.huntergatherer.storeReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jggfj.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jggfj.com/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jggfj.com/us38/www.efefcorn.buzz
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.jggfj.comReferer:
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lightscript.ru
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lightscript.ru/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lightscript.ru/us38/www.ntiled.net
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lightscript.ruReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.loxnorth.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.loxnorth.com/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.loxnorth.com/us38/www.jggfj.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.loxnorth.comReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.mymof.uk
Source: explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.mymof.uk/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.mymof.ukReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ntiled.net
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ntiled.net/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ntiled.net/us38/www.artificial-grass-61758.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ntiled.netReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.pickleontop.net
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.pickleontop.net/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.pickleontop.net/us38/www.91ye260.xyz
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.pickleontop.netReferer:
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.qdtlmj.com
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.qdtlmj.com/us38/
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.qdtlmj.com/us38/www.lightscript.ru
Source: explorer.exe, 00000002.00000003.547317918.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.534148544.000000000ED62000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.535419248.000000000ED65000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.598996843.000000000ED69000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.533865104.000000000ED57000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.qdtlmj.comReferer:
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sakkal.com
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000000.00000003.326496029.0000000006535000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.tiro.com
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.typography.netD
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.384267891.0000000007742000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000003.326991378.000000000653A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: explorer.exe, 00000002.00000002.601106968.000000001593F000.00000004.80000000.00040000.00000000.sdmp, colorcpl.exe, 00000003.00000002.585071927.0000000004E0F000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js
Source: unknown DNS traffic detected: queries for: www.qdtlmj.com
Source: global traffic HTTP traffic detected: GET /us38/?7n=ZVfFkidWioZ1z242CMU5NErFVagRqFscjwTZw32dpH9T5nOFHAt7D4fNn/kr4Wxh+xCU&5jJX=q8td9Nm HTTP/1.1Host: www.qdtlmj.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Creates a DirectInput object (often for capturing keystrokes)
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.370638921.0000000001640000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.593835130.0000000007475000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d Author: unknown
Source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: gsPzUI8EV8RoSMt.exe PID: 5480, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: gsPzUI8EV8RoSMt.exe PID: 5636, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: colorcpl.exe PID: 5808, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Uses 32bit PE files
Source: gsPzUI8EV8RoSMt.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.593835130.0000000007475000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_772cc62d os = windows, severity = x86, creation_date = 2022-05-23, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8343b5d02d74791ba2d5d52d19a759f761de2b5470d935000bc27ea6c0633f5, id = 772cc62d-345c-42d8-97ab-f67e447ddca4, last_modified = 2022-07-18
Source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: gsPzUI8EV8RoSMt.exe PID: 5480, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: gsPzUI8EV8RoSMt.exe PID: 5636, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: colorcpl.exe PID: 5808, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Detected potential crypto function
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 0_2_0158C1E4 0_2_0158C1E4
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 0_2_0158E630 0_2_0158E630
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 0_2_0158E620 0_2_0158E620
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041D9A6 1_2_0041D9A6
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041DB5E 1_2_0041DB5E
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041ED56 1_2_0041ED56
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041E560 1_2_0041E560
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041D5A3 1_2_0041D5A3
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00409E5B 1_2_00409E5B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00409E60 1_2_00409E60
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041EF85 1_2_0041EF85
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CF900 1_2_019CF900
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E4120 1_2_019E4120
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A920A8 1_2_01A920A8
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DB090 1_2_019DB090
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F20A0 1_2_019F20A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A928EC 1_2_01A928EC
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81002 1_2_01A81002
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FEBB0 1_2_019FEBB0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8DBD2 1_2_01A8DBD2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A92B28 1_2_01A92B28
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A922AE 1_2_01A922AE
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2581 1_2_019F2581
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A925DD 1_2_01A925DD
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DD5E0 1_2_019DD5E0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A92D07 1_2_01A92D07
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C0D20 1_2_019C0D20
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A91D55 1_2_01A91D55
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D841F 1_2_019D841F
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8D466 1_2_01A8D466
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A91FF1 1_2_01A91FF1
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A92EF7 1_2_01A92EF7
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E6E30 1_2_019E6E30
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8D616 1_2_01A8D616
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: String function: 019CB150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041A360 NtCreateFile, 1_2_0041A360
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041A410 NtReadFile, 1_2_0041A410
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041A490 NtClose, 1_2_0041A490
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041A540 NtAllocateVirtualMemory, 1_2_0041A540
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A099A0 NtCreateSection,LdrInitializeThunk, 1_2_01A099A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_01A09910
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A098F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_01A098F0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_01A09860
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09840 NtDelayExecution,LdrInitializeThunk, 1_2_01A09840
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09A20 NtResumeThread,LdrInitializeThunk, 1_2_01A09A20
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_01A09A00
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09A50 NtCreateFile,LdrInitializeThunk, 1_2_01A09A50
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A095D0 NtClose,LdrInitializeThunk, 1_2_01A095D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09540 NtReadFile,LdrInitializeThunk, 1_2_01A09540
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A097A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_01A097A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09780 NtMapViewOfSection,LdrInitializeThunk, 1_2_01A09780
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09710 NtQueryInformationToken,LdrInitializeThunk, 1_2_01A09710
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A096E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_01A096E0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_01A09660
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A099D0 NtCreateProcessEx, 1_2_01A099D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09950 NtQueueApcThread, 1_2_01A09950
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A098A0 NtWriteVirtualMemory, 1_2_01A098A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09820 NtEnumerateKey, 1_2_01A09820
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A0B040 NtSuspendThread, 1_2_01A0B040
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A0A3B0 NtGetContextThread, 1_2_01A0A3B0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09B00 NtSetValueKey, 1_2_01A09B00
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09A80 NtOpenDirectoryObject, 1_2_01A09A80
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09A10 NtQuerySection, 1_2_01A09A10
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A095F0 NtQueryInformationFile, 1_2_01A095F0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09520 NtWaitForSingleObject, 1_2_01A09520
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A0AD30 NtSetContextThread, 1_2_01A0AD30
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09560 NtWriteFile, 1_2_01A09560
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09FE0 NtCreateMutant, 1_2_01A09FE0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09730 NtQueryVirtualMemory, 1_2_01A09730
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A0A710 NtOpenProcessToken, 1_2_01A0A710
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09760 NtOpenProcess, 1_2_01A09760
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09770 NtSetInformationFile, 1_2_01A09770
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A0A770 NtOpenThread, 1_2_01A0A770
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A096D0 NtCreateKey, 1_2_01A096D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09610 NtEnumerateValueKey, 1_2_01A09610
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09670 NtQueryInformationProcess, 1_2_01A09670
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A09650 NtQueryValueKey, 1_2_01A09650
Sample file is different than original file name gathered from version info
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.386569301.0000000007C90000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCruiser.dll, vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.370638921.0000000001640000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.371799937.00000000032DB000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCruiser.dll, vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000000.317702199.0000000000F22000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameRoic.exe, vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.377424838.00000000042A9000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameOutimurs.dll2 vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe, 00000000.00000002.386694845.0000000007F80000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameOutimurs.dll2 vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe, 00000001.00000002.415316568.0000000001ABF000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe, 00000001.00000002.418940890.0000000001E23000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenamecolorcpl.exej% vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe, 00000001.00000003.368312531.0000000001920000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe Binary or memory string: OriginalFilenameRoic.exe, vs gsPzUI8EV8RoSMt.exe
Source: gsPzUI8EV8RoSMt.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: gsPzUI8EV8RoSMt.exe ReversingLabs: Detection: 25%
Source: gsPzUI8EV8RoSMt.exe Virustotal: Detection: 37%
Source: gsPzUI8EV8RoSMt.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process created: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process created: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe" Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0bf754aa-c967-445c-ab3d-d8fda9bae7ef}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\gsPzUI8EV8RoSMt.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/2@1/1
Source: gsPzUI8EV8RoSMt.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Mutant created: \Sessions\1\BaseNamedObjects\wDSnDrJLGdl
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5924:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: gsPzUI8EV8RoSMt.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: gsPzUI8EV8RoSMt.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: gsPzUI8EV8RoSMt.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: colorcpl.pdbGCTL source: gsPzUI8EV8RoSMt.exe, 00000001.00000002.418940890.0000000001E20000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: Roic.pdbSHA256 source: gsPzUI8EV8RoSMt.exe
Source: Binary string: colorcpl.pdb source: gsPzUI8EV8RoSMt.exe, 00000001.00000002.418940890.0000000001E20000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: gsPzUI8EV8RoSMt.exe, 00000001.00000003.368312531.0000000001801000.00000004.00000020.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000001.00000002.415316568.00000000019A0000.00000040.00001000.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000001.00000003.364658614.000000000166B000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.414988735.00000000040B8000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.584278555.000000000450F000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.584278555.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.417695049.0000000004254000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: gsPzUI8EV8RoSMt.exe, gsPzUI8EV8RoSMt.exe, 00000001.00000003.368312531.0000000001801000.00000004.00000020.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000001.00000002.415316568.00000000019A0000.00000040.00001000.00020000.00000000.sdmp, gsPzUI8EV8RoSMt.exe, 00000001.00000003.364658614.000000000166B000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.414988735.00000000040B8000.00000004.00000020.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.584278555.000000000450F000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000002.584278555.00000000043F0000.00000040.00001000.00020000.00000000.sdmp, colorcpl.exe, 00000003.00000003.417695049.0000000004254000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: Roic.pdb source: gsPzUI8EV8RoSMt.exe
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00417058 push 0271A60Ah; ret 1_2_0041705D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_004178A4 push es; ret 1_2_004178A5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_004179E9 push ds; retf 1_2_004179EE
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00417256 push edi; ret 1_2_00417263
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041D4B5 push eax; ret 1_2_0041D508
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041656D push eax; ret 1_2_0041656E
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041D56C push eax; ret 1_2_0041D572
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041D502 push eax; ret 1_2_0041D508
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0041D50B push eax; ret 1_2_0041D572
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0040EDB9 push edx; ret 1_2_0040EDBA
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A1D0D1 push ecx; ret 1_2_01A1D0E4
Binary contains a suspicious time stamp
Source: gsPzUI8EV8RoSMt.exe Static PE information: 0x8880963D [Mon Jul 28 02:47:25 2042 UTC]
Source: initial sample Static PE information: section name: .text entropy: 7.890438054015532

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x88 0x8E 0xE6
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000002569904 second address: 000000000256990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000002569B7E second address: 0000000002569B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe TID: 5484 Thread sleep time: -40023s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe TID: 5500 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe TID: 6024 Thread sleep time: -34000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\colorcpl.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00409AB0 rdtsc 1_2_00409AB0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 873 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 871 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe API coverage: 8.8 %
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Thread delayed: delay time: 40023 Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000002.00000002.594583330.0000000008645000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000002.00000003.536145955.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}i
Source: explorer.exe, 00000002.00000003.536145955.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000000.375339212.00000000043B0000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000002.00000003.533805235.000000000F043000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.600151764.000000000F046000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000002.00000003.536145955.00000000086E7000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000002.00000002.594583330.0000000008645000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_00409AB0 rdtsc 1_2_00409AB0
Enables debug privileges
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A469A6 mov eax, dword ptr fs:[00000030h] 1_2_01A469A6
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2990 mov eax, dword ptr fs:[00000030h] 1_2_019F2990
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FA185 mov eax, dword ptr fs:[00000030h] 1_2_019FA185
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A451BE mov eax, dword ptr fs:[00000030h] 1_2_01A451BE
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A451BE mov eax, dword ptr fs:[00000030h] 1_2_01A451BE
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A451BE mov eax, dword ptr fs:[00000030h] 1_2_01A451BE
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A451BE mov eax, dword ptr fs:[00000030h] 1_2_01A451BE
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EC182 mov eax, dword ptr fs:[00000030h] 1_2_019EC182
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F61A0 mov eax, dword ptr fs:[00000030h] 1_2_019F61A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F61A0 mov eax, dword ptr fs:[00000030h] 1_2_019F61A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A541E8 mov eax, dword ptr fs:[00000030h] 1_2_01A541E8
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CB1E1 mov eax, dword ptr fs:[00000030h] 1_2_019CB1E1
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CB1E1 mov eax, dword ptr fs:[00000030h] 1_2_019CB1E1
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CB1E1 mov eax, dword ptr fs:[00000030h] 1_2_019CB1E1
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C9100 mov eax, dword ptr fs:[00000030h] 1_2_019C9100
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C9100 mov eax, dword ptr fs:[00000030h] 1_2_019C9100
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C9100 mov eax, dword ptr fs:[00000030h] 1_2_019C9100
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F513A mov eax, dword ptr fs:[00000030h] 1_2_019F513A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F513A mov eax, dword ptr fs:[00000030h] 1_2_019F513A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E4120 mov eax, dword ptr fs:[00000030h] 1_2_019E4120
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E4120 mov eax, dword ptr fs:[00000030h] 1_2_019E4120
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E4120 mov eax, dword ptr fs:[00000030h] 1_2_019E4120
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E4120 mov eax, dword ptr fs:[00000030h] 1_2_019E4120
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E4120 mov ecx, dword ptr fs:[00000030h] 1_2_019E4120
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EB944 mov eax, dword ptr fs:[00000030h] 1_2_019EB944
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EB944 mov eax, dword ptr fs:[00000030h] 1_2_019EB944
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CB171 mov eax, dword ptr fs:[00000030h] 1_2_019CB171
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CB171 mov eax, dword ptr fs:[00000030h] 1_2_019CB171
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CC962 mov eax, dword ptr fs:[00000030h] 1_2_019CC962
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A090AF mov eax, dword ptr fs:[00000030h] 1_2_01A090AF
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C9080 mov eax, dword ptr fs:[00000030h] 1_2_019C9080
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FF0BF mov ecx, dword ptr fs:[00000030h] 1_2_019FF0BF
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FF0BF mov eax, dword ptr fs:[00000030h] 1_2_019FF0BF
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FF0BF mov eax, dword ptr fs:[00000030h] 1_2_019FF0BF
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A43884 mov eax, dword ptr fs:[00000030h] 1_2_01A43884
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A43884 mov eax, dword ptr fs:[00000030h] 1_2_01A43884
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F20A0 mov eax, dword ptr fs:[00000030h] 1_2_019F20A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F20A0 mov eax, dword ptr fs:[00000030h] 1_2_019F20A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F20A0 mov eax, dword ptr fs:[00000030h] 1_2_019F20A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F20A0 mov eax, dword ptr fs:[00000030h] 1_2_019F20A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F20A0 mov eax, dword ptr fs:[00000030h] 1_2_019F20A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F20A0 mov eax, dword ptr fs:[00000030h] 1_2_019F20A0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C58EC mov eax, dword ptr fs:[00000030h] 1_2_019C58EC
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_01A5B8D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5B8D0 mov ecx, dword ptr fs:[00000030h] 1_2_01A5B8D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_01A5B8D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_01A5B8D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_01A5B8D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5B8D0 mov eax, dword ptr fs:[00000030h] 1_2_01A5B8D0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A47016 mov eax, dword ptr fs:[00000030h] 1_2_01A47016
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A47016 mov eax, dword ptr fs:[00000030h] 1_2_01A47016
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A47016 mov eax, dword ptr fs:[00000030h] 1_2_01A47016
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F002D mov eax, dword ptr fs:[00000030h] 1_2_019F002D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F002D mov eax, dword ptr fs:[00000030h] 1_2_019F002D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F002D mov eax, dword ptr fs:[00000030h] 1_2_019F002D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F002D mov eax, dword ptr fs:[00000030h] 1_2_019F002D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F002D mov eax, dword ptr fs:[00000030h] 1_2_019F002D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DB02A mov eax, dword ptr fs:[00000030h] 1_2_019DB02A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DB02A mov eax, dword ptr fs:[00000030h] 1_2_019DB02A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DB02A mov eax, dword ptr fs:[00000030h] 1_2_019DB02A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DB02A mov eax, dword ptr fs:[00000030h] 1_2_019DB02A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A94015 mov eax, dword ptr fs:[00000030h] 1_2_01A94015
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A94015 mov eax, dword ptr fs:[00000030h] 1_2_01A94015
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E0050 mov eax, dword ptr fs:[00000030h] 1_2_019E0050
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E0050 mov eax, dword ptr fs:[00000030h] 1_2_019E0050
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A82073 mov eax, dword ptr fs:[00000030h] 1_2_01A82073
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A91074 mov eax, dword ptr fs:[00000030h] 1_2_01A91074
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2397 mov eax, dword ptr fs:[00000030h] 1_2_019F2397
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A95BA5 mov eax, dword ptr fs:[00000030h] 1_2_01A95BA5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FB390 mov eax, dword ptr fs:[00000030h] 1_2_019FB390
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D1B8F mov eax, dword ptr fs:[00000030h] 1_2_019D1B8F
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D1B8F mov eax, dword ptr fs:[00000030h] 1_2_019D1B8F
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8138A mov eax, dword ptr fs:[00000030h] 1_2_01A8138A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A7D380 mov ecx, dword ptr fs:[00000030h] 1_2_01A7D380
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F4BAD mov eax, dword ptr fs:[00000030h] 1_2_019F4BAD
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F4BAD mov eax, dword ptr fs:[00000030h] 1_2_019F4BAD
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F4BAD mov eax, dword ptr fs:[00000030h] 1_2_019F4BAD
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A453CA mov eax, dword ptr fs:[00000030h] 1_2_01A453CA
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A453CA mov eax, dword ptr fs:[00000030h] 1_2_01A453CA
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EDBE9 mov eax, dword ptr fs:[00000030h] 1_2_019EDBE9
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F03E2 mov eax, dword ptr fs:[00000030h] 1_2_019F03E2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F03E2 mov eax, dword ptr fs:[00000030h] 1_2_019F03E2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F03E2 mov eax, dword ptr fs:[00000030h] 1_2_019F03E2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F03E2 mov eax, dword ptr fs:[00000030h] 1_2_019F03E2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F03E2 mov eax, dword ptr fs:[00000030h] 1_2_019F03E2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F03E2 mov eax, dword ptr fs:[00000030h] 1_2_019F03E2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8131B mov eax, dword ptr fs:[00000030h] 1_2_01A8131B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CF358 mov eax, dword ptr fs:[00000030h] 1_2_019CF358
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CDB40 mov eax, dword ptr fs:[00000030h] 1_2_019CDB40
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F3B7A mov eax, dword ptr fs:[00000030h] 1_2_019F3B7A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F3B7A mov eax, dword ptr fs:[00000030h] 1_2_019F3B7A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A98B58 mov eax, dword ptr fs:[00000030h] 1_2_01A98B58
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CDB60 mov ecx, dword ptr fs:[00000030h] 1_2_019CDB60
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FD294 mov eax, dword ptr fs:[00000030h] 1_2_019FD294
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FD294 mov eax, dword ptr fs:[00000030h] 1_2_019FD294
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DAAB0 mov eax, dword ptr fs:[00000030h] 1_2_019DAAB0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DAAB0 mov eax, dword ptr fs:[00000030h] 1_2_019DAAB0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FFAB0 mov eax, dword ptr fs:[00000030h] 1_2_019FFAB0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C52A5 mov eax, dword ptr fs:[00000030h] 1_2_019C52A5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C52A5 mov eax, dword ptr fs:[00000030h] 1_2_019C52A5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C52A5 mov eax, dword ptr fs:[00000030h] 1_2_019C52A5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C52A5 mov eax, dword ptr fs:[00000030h] 1_2_019C52A5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C52A5 mov eax, dword ptr fs:[00000030h] 1_2_019C52A5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2ACB mov eax, dword ptr fs:[00000030h] 1_2_019F2ACB
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2AE4 mov eax, dword ptr fs:[00000030h] 1_2_019F2AE4
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E3A1C mov eax, dword ptr fs:[00000030h] 1_2_019E3A1C
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CAA16 mov eax, dword ptr fs:[00000030h] 1_2_019CAA16
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CAA16 mov eax, dword ptr fs:[00000030h] 1_2_019CAA16
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A04A2C mov eax, dword ptr fs:[00000030h] 1_2_01A04A2C
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A04A2C mov eax, dword ptr fs:[00000030h] 1_2_01A04A2C
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C5210 mov eax, dword ptr fs:[00000030h] 1_2_019C5210
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C5210 mov ecx, dword ptr fs:[00000030h] 1_2_019C5210
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C5210 mov eax, dword ptr fs:[00000030h] 1_2_019C5210
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C5210 mov eax, dword ptr fs:[00000030h] 1_2_019C5210
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D8A0A mov eax, dword ptr fs:[00000030h] 1_2_019D8A0A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8AA16 mov eax, dword ptr fs:[00000030h] 1_2_01A8AA16
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8AA16 mov eax, dword ptr fs:[00000030h] 1_2_01A8AA16
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A7B260 mov eax, dword ptr fs:[00000030h] 1_2_01A7B260
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A7B260 mov eax, dword ptr fs:[00000030h] 1_2_01A7B260
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A98A62 mov eax, dword ptr fs:[00000030h] 1_2_01A98A62
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A0927A mov eax, dword ptr fs:[00000030h] 1_2_01A0927A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C9240 mov eax, dword ptr fs:[00000030h] 1_2_019C9240
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C9240 mov eax, dword ptr fs:[00000030h] 1_2_019C9240
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C9240 mov eax, dword ptr fs:[00000030h] 1_2_019C9240
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C9240 mov eax, dword ptr fs:[00000030h] 1_2_019C9240
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A54257 mov eax, dword ptr fs:[00000030h] 1_2_01A54257
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8EA55 mov eax, dword ptr fs:[00000030h] 1_2_01A8EA55
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FFD9B mov eax, dword ptr fs:[00000030h] 1_2_019FFD9B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FFD9B mov eax, dword ptr fs:[00000030h] 1_2_019FFD9B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A905AC mov eax, dword ptr fs:[00000030h] 1_2_01A905AC
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A905AC mov eax, dword ptr fs:[00000030h] 1_2_01A905AC
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C2D8A mov eax, dword ptr fs:[00000030h] 1_2_019C2D8A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C2D8A mov eax, dword ptr fs:[00000030h] 1_2_019C2D8A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C2D8A mov eax, dword ptr fs:[00000030h] 1_2_019C2D8A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C2D8A mov eax, dword ptr fs:[00000030h] 1_2_019C2D8A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C2D8A mov eax, dword ptr fs:[00000030h] 1_2_019C2D8A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2581 mov eax, dword ptr fs:[00000030h] 1_2_019F2581
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2581 mov eax, dword ptr fs:[00000030h] 1_2_019F2581
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2581 mov eax, dword ptr fs:[00000030h] 1_2_019F2581
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F2581 mov eax, dword ptr fs:[00000030h] 1_2_019F2581
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F1DB5 mov eax, dword ptr fs:[00000030h] 1_2_019F1DB5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F1DB5 mov eax, dword ptr fs:[00000030h] 1_2_019F1DB5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F1DB5 mov eax, dword ptr fs:[00000030h] 1_2_019F1DB5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F35A1 mov eax, dword ptr fs:[00000030h] 1_2_019F35A1
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8FDE2 mov eax, dword ptr fs:[00000030h] 1_2_01A8FDE2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8FDE2 mov eax, dword ptr fs:[00000030h] 1_2_01A8FDE2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8FDE2 mov eax, dword ptr fs:[00000030h] 1_2_01A8FDE2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8FDE2 mov eax, dword ptr fs:[00000030h] 1_2_01A8FDE2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A78DF1 mov eax, dword ptr fs:[00000030h] 1_2_01A78DF1
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46DC9 mov eax, dword ptr fs:[00000030h] 1_2_01A46DC9
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46DC9 mov eax, dword ptr fs:[00000030h] 1_2_01A46DC9
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46DC9 mov eax, dword ptr fs:[00000030h] 1_2_01A46DC9
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46DC9 mov ecx, dword ptr fs:[00000030h] 1_2_01A46DC9
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46DC9 mov eax, dword ptr fs:[00000030h] 1_2_01A46DC9
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46DC9 mov eax, dword ptr fs:[00000030h] 1_2_01A46DC9
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DD5E0 mov eax, dword ptr fs:[00000030h] 1_2_019DD5E0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DD5E0 mov eax, dword ptr fs:[00000030h] 1_2_019DD5E0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8E539 mov eax, dword ptr fs:[00000030h] 1_2_01A8E539
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A4A537 mov eax, dword ptr fs:[00000030h] 1_2_01A4A537
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A98D34 mov eax, dword ptr fs:[00000030h] 1_2_01A98D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F4D3B mov eax, dword ptr fs:[00000030h] 1_2_019F4D3B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F4D3B mov eax, dword ptr fs:[00000030h] 1_2_019F4D3B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F4D3B mov eax, dword ptr fs:[00000030h] 1_2_019F4D3B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D3D34 mov eax, dword ptr fs:[00000030h] 1_2_019D3D34
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CAD30 mov eax, dword ptr fs:[00000030h] 1_2_019CAD30
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E7D50 mov eax, dword ptr fs:[00000030h] 1_2_019E7D50
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A03D43 mov eax, dword ptr fs:[00000030h] 1_2_01A03D43
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A43540 mov eax, dword ptr fs:[00000030h] 1_2_01A43540
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EC577 mov eax, dword ptr fs:[00000030h] 1_2_019EC577
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EC577 mov eax, dword ptr fs:[00000030h] 1_2_019EC577
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D849B mov eax, dword ptr fs:[00000030h] 1_2_019D849B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A814FB mov eax, dword ptr fs:[00000030h] 1_2_01A814FB
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46CF0 mov eax, dword ptr fs:[00000030h] 1_2_01A46CF0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46CF0 mov eax, dword ptr fs:[00000030h] 1_2_01A46CF0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46CF0 mov eax, dword ptr fs:[00000030h] 1_2_01A46CF0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A98CD6 mov eax, dword ptr fs:[00000030h] 1_2_01A98CD6
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A9740D mov eax, dword ptr fs:[00000030h] 1_2_01A9740D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A9740D mov eax, dword ptr fs:[00000030h] 1_2_01A9740D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A9740D mov eax, dword ptr fs:[00000030h] 1_2_01A9740D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81C06 mov eax, dword ptr fs:[00000030h] 1_2_01A81C06
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46C0A mov eax, dword ptr fs:[00000030h] 1_2_01A46C0A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46C0A mov eax, dword ptr fs:[00000030h] 1_2_01A46C0A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46C0A mov eax, dword ptr fs:[00000030h] 1_2_01A46C0A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A46C0A mov eax, dword ptr fs:[00000030h] 1_2_01A46C0A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FBC2C mov eax, dword ptr fs:[00000030h] 1_2_019FBC2C
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FA44B mov eax, dword ptr fs:[00000030h] 1_2_019FA44B
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019E746D mov eax, dword ptr fs:[00000030h] 1_2_019E746D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5C450 mov eax, dword ptr fs:[00000030h] 1_2_01A5C450
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5C450 mov eax, dword ptr fs:[00000030h] 1_2_01A5C450
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D8794 mov eax, dword ptr fs:[00000030h] 1_2_019D8794
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A47794 mov eax, dword ptr fs:[00000030h] 1_2_01A47794
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A47794 mov eax, dword ptr fs:[00000030h] 1_2_01A47794
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A47794 mov eax, dword ptr fs:[00000030h] 1_2_01A47794
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A037F5 mov eax, dword ptr fs:[00000030h] 1_2_01A037F5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EF716 mov eax, dword ptr fs:[00000030h] 1_2_019EF716
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FA70E mov eax, dword ptr fs:[00000030h] 1_2_019FA70E
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FA70E mov eax, dword ptr fs:[00000030h] 1_2_019FA70E
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A9070D mov eax, dword ptr fs:[00000030h] 1_2_01A9070D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A9070D mov eax, dword ptr fs:[00000030h] 1_2_01A9070D
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FE730 mov eax, dword ptr fs:[00000030h] 1_2_019FE730
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C4F2E mov eax, dword ptr fs:[00000030h] 1_2_019C4F2E
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019C4F2E mov eax, dword ptr fs:[00000030h] 1_2_019C4F2E
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5FF10 mov eax, dword ptr fs:[00000030h] 1_2_01A5FF10
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5FF10 mov eax, dword ptr fs:[00000030h] 1_2_01A5FF10
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A98F6A mov eax, dword ptr fs:[00000030h] 1_2_01A98F6A
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DEF40 mov eax, dword ptr fs:[00000030h] 1_2_019DEF40
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019DFF60 mov eax, dword ptr fs:[00000030h] 1_2_019DFF60
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A446A7 mov eax, dword ptr fs:[00000030h] 1_2_01A446A7
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A90EA5 mov eax, dword ptr fs:[00000030h] 1_2_01A90EA5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A90EA5 mov eax, dword ptr fs:[00000030h] 1_2_01A90EA5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A90EA5 mov eax, dword ptr fs:[00000030h] 1_2_01A90EA5
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A5FE87 mov eax, dword ptr fs:[00000030h] 1_2_01A5FE87
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F36CC mov eax, dword ptr fs:[00000030h] 1_2_019F36CC
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A7FEC0 mov eax, dword ptr fs:[00000030h] 1_2_01A7FEC0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A08EC7 mov eax, dword ptr fs:[00000030h] 1_2_01A08EC7
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F16E0 mov ecx, dword ptr fs:[00000030h] 1_2_019F16E0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A98ED6 mov eax, dword ptr fs:[00000030h] 1_2_01A98ED6
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D76E2 mov eax, dword ptr fs:[00000030h] 1_2_019D76E2
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FA61C mov eax, dword ptr fs:[00000030h] 1_2_019FA61C
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019FA61C mov eax, dword ptr fs:[00000030h] 1_2_019FA61C
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A7FE3F mov eax, dword ptr fs:[00000030h] 1_2_01A7FE3F
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CC600 mov eax, dword ptr fs:[00000030h] 1_2_019CC600
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CC600 mov eax, dword ptr fs:[00000030h] 1_2_019CC600
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CC600 mov eax, dword ptr fs:[00000030h] 1_2_019CC600
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019F8E00 mov eax, dword ptr fs:[00000030h] 1_2_019F8E00
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A81608 mov eax, dword ptr fs:[00000030h] 1_2_01A81608
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019CE620 mov eax, dword ptr fs:[00000030h] 1_2_019CE620
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D7E41 mov eax, dword ptr fs:[00000030h] 1_2_019D7E41
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D7E41 mov eax, dword ptr fs:[00000030h] 1_2_019D7E41
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D7E41 mov eax, dword ptr fs:[00000030h] 1_2_019D7E41
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D7E41 mov eax, dword ptr fs:[00000030h] 1_2_019D7E41
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D7E41 mov eax, dword ptr fs:[00000030h] 1_2_019D7E41
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D7E41 mov eax, dword ptr fs:[00000030h] 1_2_019D7E41
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8AE44 mov eax, dword ptr fs:[00000030h] 1_2_01A8AE44
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_01A8AE44 mov eax, dword ptr fs:[00000030h] 1_2_01A8AE44
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EAE73 mov eax, dword ptr fs:[00000030h] 1_2_019EAE73
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EAE73 mov eax, dword ptr fs:[00000030h] 1_2_019EAE73
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EAE73 mov eax, dword ptr fs:[00000030h] 1_2_019EAE73
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EAE73 mov eax, dword ptr fs:[00000030h] 1_2_019EAE73
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019EAE73 mov eax, dword ptr fs:[00000030h] 1_2_019EAE73
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_019D766D mov eax, dword ptr fs:[00000030h] 1_2_019D766D
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Code function: 1_2_0040ACF0 LdrLoadDll, 1_2_0040ACF0
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 194.50.194.150 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.qdtlmj.com
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Section unmapped: C:\Windows\SysWOW64\colorcpl.exe base address: 150000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Thread register set: target process: 3324 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Thread register set: target process: 3324 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Process created: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe" Jump to behavior
Source: explorer.exe, 00000002.00000000.380251366.0000000005910000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000003.547817428.00000000086B6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.591112099.0000000005910000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000002.00000002.584016704.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.371786582.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: uProgram Manager*r
Source: explorer.exe, 00000002.00000002.584016704.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.371786582.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000002.00000002.584016704.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000002.00000000.371786582.0000000000ED0000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000002.00000000.371135857.0000000000878000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000002.00000002.583649197.0000000000878000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanLoc*U
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\arial.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ariali.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\arialbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\arialbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ARIALN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ariblk.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ARIALNI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ARIALNB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ARIALNBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\bahnschrift.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\calibri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\calibril.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\calibrii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\calibrili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\calibrib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\calibriz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\cambria.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\cambriai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\cambriab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\cambriaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\Candara.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\Candarai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\Candarab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\Candaraz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\comic.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\comici.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\comicbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\comicz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\consola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\consolai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\consolab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\consolaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\constan.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\constani.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\constanb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\constanz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\corbel.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\corbeli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\corbelb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\corbelz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\cour.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\couri.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\courbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\courbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ebrima.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ebrimabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\framd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRADM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\framdit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRADMIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRAMDCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRADMCN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRAHV.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRAHVIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\Gabriola.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\gadugi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\gadugib.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\georgia.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\georgiai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\georgiab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\georgiaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\Inkfree.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\javatext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LeelawUI.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LeelUIsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LeelaUIb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\lucon.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\l_10646.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\malgun.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\malgunsl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\malgunbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\himalaya.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\msjh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\msjhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\msjhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ntailu.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ntailub.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\phagspa.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\phagspab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\taile.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\taileb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\msyh.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\msyhl.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\msyhbd.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\msyi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\mingliub.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\monbaiti.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\msgothic.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\mvboli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\mmrtext.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\mmrtextb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\Nirmala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\NirmalaS.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\NirmalaB.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\pala.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\palai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\palab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\palabi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\segoepr.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\segoeprb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\segoesc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\segoescb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\segoeuii.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\seguisli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\seguili.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\seguisbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\segoeuiz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\seguibl.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\seguibli.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\seguiemj.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\seguihis.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\seguisym.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\simsun.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\simsunb.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\Sitka.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SitkaI.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SitkaB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SitkaZ.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\sylfaen.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\symbol.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\tahoma.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\tahomabd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\timesi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\timesbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\timesbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\trebuc.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\trebucit.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\trebucbd.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\trebucbi.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\verdana.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\verdanai.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\verdanab.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\verdanaz.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\webdings.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\wingding.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\YuGothR.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\YuGothM.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\YuGothL.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\YuGothB.ttc VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\holomdl2.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CENTURY.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LEELAWAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LEELAWDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MSUIGHUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MSUIGHUB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\WINGDNG2.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\WINGDNG3.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\TEMPSITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PRISTINA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PAPYRUS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MISTRAL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LHANDW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ITCKRIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\JUICE___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRSCRIPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FREESCPT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BRADHITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\OUTLOOK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BKANT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ANTQUAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ANTQUAB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ANTQUABI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GARA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GARAIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GARABD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MTCORSVA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GOTHIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GOTHICI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GOTHICB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GOTHICBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ALGER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BASKVILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BAUHS93.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BELL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BELLI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BELLB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BRLNSR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BRLNSDB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BRLNSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BERNHC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_PSTC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BRITANIC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BROADW.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BRUSHSCI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CALIFR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CALIFI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CALIFB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CENTAUR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CHILLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\COLONNA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\COOPBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FTLTLT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\HARLOWSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\HARNGTON.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\HTOWERT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\HTOWERTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\JOKERMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\KUNSTLER.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LBRITE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LBRITED.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LBRITEI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LBRITEDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LCALLIG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LFAX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LFAXD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LFAXI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LFAXDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MAGNETOB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MATURASC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MOD20.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\NIAGENG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\NIAGSOL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\OLDENGL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ONYX.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PARCHM.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PLAYBILL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\POORICH.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\RAVIE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\INFROMAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SHOWG.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SNAP____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\STENCIL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\VINERITC.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\VIVALDII.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\VLADIMIR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LATINWD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\TCM_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\TCMI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\TCB_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\TCBI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\TCCM____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\TCCB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\TCCEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SCRIPTBL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ROCK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ROCKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ROCKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ROCKEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ROCKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ROCC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ROCCB___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\RAGE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PERTILI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PERTIBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PER_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PERI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PERB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PERBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\PALSCRI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\OCRAEXT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MAIAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LTYPE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LTYPEO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LTYPEB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LTYPEBO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LSANS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LSANSD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LSANSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\LSANSDI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\IMPRISHA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\HATTEN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GOUDYSTO.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GOUDOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GOUDOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GOUDOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GLECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GIL_____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GILI____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GILB____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GILBI___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GILC____.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GLSNECB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\GIGI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRABK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FRABKIT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FORTE.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\FELIXTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ERASMD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ERASLGHT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ERASDEMI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ERASBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ENGR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ELEPHNT.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ELEPHNTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ITCEDSCR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CURLZ___.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\COPRGTL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\COPRGTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CENSCBK.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SCHLBKI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SCHLBKB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\SCHLBKBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CASTELAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CALIST.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CALISTI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CALISTB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\CALISTBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOOKOS.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOOKOSB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOOKOSI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOOKOSBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_R.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_I.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_B.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_BI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_CR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_BLAR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_CI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_CB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_BLAI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BOD_CBI.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ITCBLKAD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\ARLRDBD.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\AGENCYR.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\AGENCYB.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\BSSYM7.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\REFSAN.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\REFSPCL.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\MTEXTRA.TTF VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\marlett.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\impact.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\gsPzUI8EV8RoSMt.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.gsPzUI8EV8RoSMt.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gsPzUI8EV8RoSMt.exe.4860dd0.4.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.gsPzUI8EV8RoSMt.exe.4606d30.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000003.00000002.583708430.0000000000400000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.414573868.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.377424838.00000000044A2000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.377424838.0000000004860000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.583748187.0000000002460000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.583808848.0000000002560000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 830457 Sample: gsPzUI8EV8RoSMt.exe Startdate: 20/03/2023 Architecture: WINDOWS Score: 100 32 Malicious sample detected (through community Yara rule) 2->32 34 Antivirus detection for URL or domain 2->34 36 Multi AV Scanner detection for submitted file 2->36 38 4 other signatures 2->38 10 gsPzUI8EV8RoSMt.exe 3 2->10         started        process3 file4 28 C:\Users\user\...\gsPzUI8EV8RoSMt.exe.log, ASCII 10->28 dropped 48 Tries to detect virtualization through RDTSC time measurements 10->48 14 gsPzUI8EV8RoSMt.exe 10->14         started        signatures5 process6 signatures7 50 Modifies the context of a thread in another process (thread injection) 14->50 52 Maps a DLL or memory area into another process 14->52 54 Sample uses process hollowing technique 14->54 56 Queues an APC in another process (thread injection) 14->56 17 explorer.exe 1 1 14->17 injected process8 dnsIp9 30 www.qdtlmj.com 194.50.194.150, 49680, 80 QUICKPACKETUS United Kingdom 17->30 40 System process connects to network (likely due to code injection or exploit) 17->40 21 colorcpl.exe 17->21         started        signatures10 process11 signatures12 42 Modifies the context of a thread in another process (thread injection) 21->42 44 Maps a DLL or memory area into another process 21->44 46 Tries to detect virtualization through RDTSC time measurements 21->46 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
194.50.194.150
 www.qdtlmj.com United Kingdom
46261 QUICKPACKETUS true

Contacted Domains

Name IP Active
www.qdtlmj.com 194.50.194.150 true

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.qdtlmj.com/us38/?7n=ZVfFkidWioZ1z242CMU5NErFVagRqFscjwTZw32dpH9T5nOFHAt7D4fNn/kr4Wxh+xCU&5jJX=q8td9Nm true
  • Avira URL Cloud: malware
 unknown
www.pickleontop.net/us38/ true
  • Avira URL Cloud: safe
 low