Windows Analysis Report
FGGx944Qu7.exe

Overview

General Information

Sample name: FGGx944Qu7.exe
renamed because original name is a hash value
Original sample name: 21d18e20b8b0e17e0b554b5940a7aaed.exe
Analysis ID: 1443953
MD5: 21d18e20b8b0e17e0b554b5940a7aaed
SHA1: bad65794a2bc8c23d373f82e11978f11af1af57d
SHA256: b600c43e2980691952532a79e7a0aef2351aeef6f740fd2f56647509c93b6da0
Tags: 32exetrojan
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Antivirus detection for dropped file
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Sigma detected: Scheduled temp file as task from temp location
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains method to dynamically call methods (often used by packers)
.NET source code contains potential unpacker
Adds a directory exclusion to Windows Defender
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for dropped file
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Mail credentials (via file / registry access)
Uses schtasks.exe or at.exe to add and modify task schedules
Adds / modifies Windows certificates
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
IP address seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Sigma detected: Suspicious Add Scheduled Task Parent
Sigma detected: Suspicious Schtasks From Env Var Folder
Stores large binary data to the registry
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: FGGx944Qu7.exe Avira: detected
Antivirus detection for URL or domain
Source: http://www.drapples.club/q0r6/ Avira URL Cloud: Label: phishing
Source: http://www.drapples.club Avira URL Cloud: Label: phishing
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Avira: detection malicious, Label: HEUR/AGEN.1304432
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe ReversingLabs: Detection: 62%
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Virustotal: Detection: 67% Perma Link
Multi AV Scanner detection for submitted file
Source: FGGx944Qu7.exe ReversingLabs: Detection: 62%
Source: FGGx944Qu7.exe Virustotal: Detection: 67% Perma Link
Yara detected FormBook
Source: Yara match File source: 8.2.FGGx944Qu7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.FGGx944Qu7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.2863758312.0000000003070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2861231272.0000000002A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1946159228.0000000001510000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1945331228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2863668034.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2863047851.0000000004760000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1948193173.0000000003810000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Joe Sandbox ML: detected
Machine Learning detection for sample
Source: FGGx944Qu7.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: FGGx944Qu7.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: FGGx944Qu7.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: usFxdnRPYjnb.exe, 0000000F.00000000.1869462009.0000000000FAE000.00000002.00000001.01000000.0000000A.sdmp, usFxdnRPYjnb.exe, 00000013.00000000.2032183269.0000000000FAE000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: wntdll.pdbUGP source: FGGx944Qu7.exe, 00000008.00000002.1946419926.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.1947640704.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2864118086.000000000342E000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.1945593903.0000000002F32000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2864118086.0000000003290000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: FGGx944Qu7.exe, FGGx944Qu7.exe, 00000008.00000002.1946419926.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.1947640704.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2864118086.000000000342E000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.1945593903.0000000002F32000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2864118086.0000000003290000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: SearchProtocolHost.pdbUGP source: usFxdnRPYjnb.exe, 0000000F.00000003.1884595652.0000000000C8B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: SearchProtocolHost.pdb source: usFxdnRPYjnb.exe, 0000000F.00000003.1884595652.0000000000C8B000.00000004.00000001.00020000.00000000.sdmp
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 4x nop then jmp 0FB01D2Dh 0_2_0FB01F6A
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.149.87.45 34.149.87.45
Source: Joe Sandbox View IP Address: 199.59.243.225 199.59.243.225
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /q0r6/?uZgP=5pyvScKx6ZbOO2uX774/2f03V4PpvoLdLg/OCd1FMvXsxJY7YeHi6SxOzHnr25kvmJZHa8XXHydHc3e54xwdxF+eQrhYMnjeuarocBe7v18XiUqzaWXVlPw=&a6m=8Rw4HDhPzbgPS HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USHost: www.oobzxod2xn.ccConnection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0
Source: global traffic DNS traffic detected: DNS query: www.birthingwitht.com
Source: global traffic DNS traffic detected: DNS query: www.oobzxod2xn.cc
Source: global traffic DNS traffic detected: DNS query: www.drapples.club
Source: unknown HTTP traffic detected: POST /q0r6/ HTTP/1.1Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.7Accept-Language: en-USAccept-Encoding: gzip, deflate, brHost: www.drapples.clubOrigin: http://www.drapples.clubReferer: http://www.drapples.club/q0r6/Cache-Control: no-cacheContent-Type: application/x-www-form-urlencodedContent-Length: 201Connection: closeUser-Agent: Mozilla/5.0 (Windows NT 6.0; WOW64; rv:35.0) Gecko/20100101 Firefox/35.0Data Raw: 75 5a 67 50 3d 36 54 37 73 6c 75 67 4c 55 76 59 57 51 53 5a 7a 65 38 54 44 57 75 2f 74 6a 45 67 77 77 4a 67 6d 63 67 50 70 30 4c 47 57 51 37 58 70 48 6e 51 4f 51 6b 50 50 47 37 69 57 30 6c 57 31 6d 4c 2f 41 6a 78 5a 52 4c 4e 57 58 69 6d 68 44 73 45 73 75 39 70 7a 68 42 4a 71 67 48 48 70 55 2b 37 66 71 6d 42 75 44 33 75 4b 68 66 32 32 71 4e 6f 46 62 6a 32 72 39 4d 78 43 68 6e 50 77 57 65 30 47 64 76 37 4f 75 69 65 65 4e 74 43 4c 48 71 59 71 4e 41 70 50 4a 48 2f 77 77 68 4c 45 75 64 4d 76 6b 36 52 30 39 7a 69 4e 55 67 56 4e 69 70 39 65 75 51 48 37 67 6a 44 44 43 6b 50 38 68 2b 2b 38 74 4f 51 3d 3d Data Ascii: uZgP=6T7slugLUvYWQSZze8TDWu/tjEgwwJgmcgPp0LGWQ7XpHnQOQkPPG7iW0lW1mL/AjxZRLNWXimhDsEsu9pzhBJqgHHpU+7fqmBuD3uKhf22qNoFbj2r9MxChnPwWe0Gdv7OuieeNtCLHqYqNApPJH/wwhLEudMvk6R09ziNUgVNip9euQH7gjDDCkP8h++8tOQ==
Source: FGGx944Qu7.exe, TBsjWljiCpR.exe.0.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACertificationAuthority.crl0q
Source: FGGx944Qu7.exe, TBsjWljiCpR.exe.0.dr String found in binary or memory: http://crl.comodoca.com/COMODORSACodeSigningCA.crl0t
Source: FGGx944Qu7.exe, TBsjWljiCpR.exe.0.dr String found in binary or memory: http://ocsp.comodoca.com0
Source: FGGx944Qu7.exe, 00000000.00000002.1688859188.000000000326F000.00000004.00000800.00020000.00000000.sdmp, TBsjWljiCpR.exe, 00000009.00000002.1885020055.0000000003091000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: usFxdnRPYjnb.exe, 00000013.00000002.2865529929.0000000005731000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.drapples.club
Source: usFxdnRPYjnb.exe, 00000013.00000002.2865529929.0000000005731000.00000040.80000000.00040000.00000000.sdmp String found in binary or memory: http://www.drapples.club/q0r6/
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ac.ecosia.org/autocomplete?q=
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://cdn.ecosia.org/assets/images/ico/favicon.icohttps://www.ecosia.org/search?q=
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/favicon.icohttps://ch.search.yahoo.com/search
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ch.search.yahoo.com/sugg/chrome?output=fxjson&appid=crmas&command=
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/ac/?q=
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/chrome_newtab
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://duckduckgo.com/favicon.icohttps://duckduckgo.com/?q=
Source: SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srf?client_id=00000000480728C5&scope=service::ssl.live.com:
Source: SearchProtocolHost.exe, 00000010.00000003.2407310334.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_authorize.srfclient_id=00000000480728C5&scope=service::ssl.live.com::
Source: SearchProtocolHost.exe, 00000010.00000003.2407310334.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033
Source: SearchProtocolHost.exe, 00000010.00000003.2407310334.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srf?lc=1033LMEM
Source: SearchProtocolHost.exe, 00000010.00000003.2407310334.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_desktop.srflc=1033
Source: SearchProtocolHost.exe, 00000010.00000003.2407310334.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srf?client_id=00000000480728C5&redirect_uri=https://login.live
Source: SearchProtocolHost.exe, 00000010.00000003.2407310334.0000000002CD8000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002CC9000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfclient_id=00000000480728C5&redirect_uri=https://login.live.
Source: SearchProtocolHost.exe, 00000010.00000003.2406556463.00000000079FB000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://login.live.com/oauth20_logout.srfhttps://login.live.com/oauth20_authorize.srfhttps://login.l
Source: FGGx944Qu7.exe, TBsjWljiCpR.exe.0.dr String found in binary or memory: https://www.chiark.greenend.org.uk/~sgtatham/putty/0
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.ecosia.org/newtab/
Source: SearchProtocolHost.exe, 00000010.00000003.2412246200.0000000007A18000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com/images/branding/product/ico/googleg_lodp.ico

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.FGGx944Qu7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.FGGx944Qu7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.2863758312.0000000003070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2861231272.0000000002A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1946159228.0000000001510000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1945331228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2863668034.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2863047851.0000000004760000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1948193173.0000000003810000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 8.2.FGGx944Qu7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 8.2.FGGx944Qu7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.2863758312.0000000003070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.2861231272.0000000002A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1946159228.0000000001510000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1945331228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000010.00000002.2863668034.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000D.00000002.2030469230.0000000000417000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0000000F.00000002.2863047851.0000000004760000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000008.00000002.1948193173.0000000003810000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0042AEF3 NtClose, 8_2_0042AEF3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040A5A8 NtMapViewOfSection, 8_2_0040A5A8
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632B60 NtClose,LdrInitializeThunk, 8_2_01632B60
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632DF0 NtQuerySystemInformation,LdrInitializeThunk, 8_2_01632DF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632C70 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_01632C70
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016335C0 NtCreateMutant,LdrInitializeThunk, 8_2_016335C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01634340 NtSetContextThread, 8_2_01634340
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01634650 NtSuspendThread, 8_2_01634650
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632BE0 NtQueryValueKey, 8_2_01632BE0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632BF0 NtAllocateVirtualMemory, 8_2_01632BF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632BA0 NtEnumerateValueKey, 8_2_01632BA0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632B80 NtQueryInformationFile, 8_2_01632B80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632AF0 NtWriteFile, 8_2_01632AF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632AD0 NtReadFile, 8_2_01632AD0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632AB0 NtWaitForSingleObject, 8_2_01632AB0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632D30 NtUnmapViewOfSection, 8_2_01632D30
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632D00 NtSetInformationFile, 8_2_01632D00
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632D10 NtMapViewOfSection, 8_2_01632D10
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632DD0 NtDelayExecution, 8_2_01632DD0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632DB0 NtEnumerateKey, 8_2_01632DB0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632C60 NtCreateKey, 8_2_01632C60
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632C00 NtQueryInformationProcess, 8_2_01632C00
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632CF0 NtOpenProcess, 8_2_01632CF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632CC0 NtQueryVirtualMemory, 8_2_01632CC0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632CA0 NtQueryInformationToken, 8_2_01632CA0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632F60 NtCreateProcessEx, 8_2_01632F60
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632F30 NtCreateSection, 8_2_01632F30
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632FE0 NtCreateFile, 8_2_01632FE0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632FA0 NtQuerySection, 8_2_01632FA0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632FB0 NtResumeThread, 8_2_01632FB0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632F90 NtProtectVirtualMemory, 8_2_01632F90
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632E30 NtWriteVirtualMemory, 8_2_01632E30
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632EE0 NtQueueApcThread, 8_2_01632EE0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632EA0 NtAdjustPrivilegesToken, 8_2_01632EA0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632E80 NtReadVirtualMemory, 8_2_01632E80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01633010 NtOpenDirectoryObject, 8_2_01633010
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01633090 NtSetValueKey, 8_2_01633090
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016339B0 NtGetContextThread, 8_2_016339B0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01633D70 NtOpenThread, 8_2_01633D70
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01633D10 NtOpenProcessToken, 8_2_01633D10
Detected potential crypto function
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 0_2_015EDFEC 0_2_015EDFEC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 0_2_054ED1B8 0_2_054ED1B8
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 0_2_054E68C0 0_2_054E68C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 0_2_054E0040 0_2_054E0040
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 0_2_054E0006 0_2_054E0006
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 0_2_054E68B0 0_2_054E68B0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00402853 8_2_00402853
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00402860 8_2_00402860
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00401150 8_2_00401150
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00403270 8_2_00403270
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_004012C0 8_2_004012C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040FA8A 8_2_0040FA8A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040FA93 8_2_0040FA93
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0042D323 8_2_0042D323
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_004163DE 8_2_004163DE
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_004163E3 8_2_004163E3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00402440 8_2_00402440
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040FCB3 8_2_0040FCB3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040DD33 8_2_0040DD33
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00401D80 8_2_00401D80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01688158 8_2_01688158
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0100 8_2_015F0100
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169A118 8_2_0169A118
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B81CC 8_2_016B81CC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C01AA 8_2_016C01AA
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B41A2 8_2_016B41A2
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BA352 8_2_016BA352
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C03E6 8_2_016C03E6
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E3F0 8_2_0160E3F0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016802C0 8_2_016802C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600535 8_2_01600535
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C0591 8_2_016C0591
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B2446 8_2_016B2446
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A4420 8_2_016A4420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AE4F6 8_2_016AE4F6
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01624750 8_2_01624750
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FC7C0 8_2_015FC7C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161C6E0 8_2_0161C6E0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01616962 8_2_01616962
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016CA9A6 8_2_016CA9A6
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160A840 8_2_0160A840
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01602840 8_2_01602840
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E8F0 8_2_0162E8F0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E68B8 8_2_015E68B8
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BAB40 8_2_016BAB40
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B6BD7 8_2_016B6BD7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160AD00 8_2_0160AD00
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169CD1F 8_2_0169CD1F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FADE0 8_2_015FADE0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01618DBF 8_2_01618DBF
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600C00 8_2_01600C00
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0CF2 8_2_015F0CF2
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0CB5 8_2_016A0CB5
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01674F40 8_2_01674F40
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01642F28 8_2_01642F28
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01620F30 8_2_01620F30
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A2F30 8_2_016A2F30
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F2FC8 8_2_015F2FC8
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167EFA0 8_2_0167EFA0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600E59 8_2_01600E59
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BEE26 8_2_016BEE26
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BEEDB 8_2_016BEEDB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01612E90 8_2_01612E90
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BCE93 8_2_016BCE93
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016CB16B 8_2_016CB16B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0163516C 8_2_0163516C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EF172 8_2_015EF172
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160B1B0 8_2_0160B1B0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B70E9 8_2_016B70E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BF0E0 8_2_016BF0E0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016070C0 8_2_016070C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AF0CC 8_2_016AF0CC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015ED34C 8_2_015ED34C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B132D 8_2_016B132D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0164739A 8_2_0164739A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A12ED 8_2_016A12ED
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161D2F0 8_2_0161D2F0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161B2C0 8_2_0161B2C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016052A0 8_2_016052A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B7571 8_2_016B7571
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169D5B0 8_2_0169D5B0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F1460 8_2_015F1460
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BF43F 8_2_016BF43F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BF7B0 8_2_016BF7B0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B16CC 8_2_016B16CC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01609950 8_2_01609950
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161B950 8_2_0161B950
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01695910 8_2_01695910
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166D800 8_2_0166D800
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016038E0 8_2_016038E0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BFB76 8_2_016BFB76
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01675BF0 8_2_01675BF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0163DBF9 8_2_0163DBF9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161FB80 8_2_0161FB80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01673A6C 8_2_01673A6C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BFA49 8_2_016BFA49
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B7A46 8_2_016B7A46
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016ADAC6 8_2_016ADAC6
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01645AA0 8_2_01645AA0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169DAAC 8_2_0169DAAC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A1AA3 8_2_016A1AA3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B7D73 8_2_016B7D73
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01603D40 8_2_01603D40
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B1D5A 8_2_016B1D5A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161FDC0 8_2_0161FDC0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01679C32 8_2_01679C32
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BFCF2 8_2_016BFCF2
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BFF09 8_2_016BFF09
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BFFB1 8_2_016BFFB1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01601F92 8_2_01601F92
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01609EB0 8_2_01609EB0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_0161DFEC 9_2_0161DFEC
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F34130 9_2_02F34130
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F38860 9_2_02F38860
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F3C3A8 9_2_02F3C3A8
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F34120 9_2_02F34120
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F3C7E0 9_2_02F3C7E0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F3C7D3 9_2_02F3C7D3
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F3DA80 9_2_02F3DA80
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F33B80 9_2_02F33B80
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F33B70 9_2_02F33B70
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F3BB33 9_2_02F3BB33
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F3BB38 9_2_02F3BB38
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F3BF70 9_2_02F3BF70
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F34D20 9_2_02F34D20
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 9_2_02F34D10 9_2_02F34D10
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01040100 13_2_01040100
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01096000 13_2_01096000
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010D02C0 13_2_010D02C0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01050535 13_2_01050535
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01074750 13_2_01074750
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01050770 13_2_01050770
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0104C7C0 13_2_0104C7C0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0106C6E0 13_2_0106C6E0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01066962 13_2_01066962
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010529A0 13_2_010529A0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01052840 13_2_01052840
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0105A840 13_2_0105A840
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01088890 13_2_01088890
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010368B8 13_2_010368B8
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0107E8F0 13_2_0107E8F0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0104EA80 13_2_0104EA80
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0105AD00 13_2_0105AD00
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0105ED7A 13_2_0105ED7A
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01068DBF 13_2_01068DBF
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01058DC0 13_2_01058DC0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0104ADE0 13_2_0104ADE0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01050C00 13_2_01050C00
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01040CF2 13_2_01040CF2
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01092F28 13_2_01092F28
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01070F30 13_2_01070F30
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010C4F40 13_2_010C4F40
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010CEFA0 13_2_010CEFA0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01042FC8 13_2_01042FC8
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01050E59 13_2_01050E59
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01062E90 13_2_01062E90
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0108516C 13_2_0108516C
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0103F172 13_2_0103F172
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0105B1B0 13_2_0105B1B0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0103D34C 13_2_0103D34C
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010533F3 13_2_010533F3
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010552A0 13_2_010552A0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0106B2C0 13_2_0106B2C0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0106D2F0 13_2_0106D2F0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01041460 13_2_01041460
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01053497 13_2_01053497
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010974E0 13_2_010974E0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0105B730 13_2_0105B730
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01059950 13_2_01059950
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0106B950 13_2_0106B950
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01055990 13_2_01055990
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010BD800 13_2_010BD800
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0106FB80 13_2_0106FB80
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0108DBF9 13_2_0108DBF9
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010C5BF0 13_2_010C5BF0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010C3A6C 13_2_010C3A6C
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01053D40 13_2_01053D40
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0106FDC0 13_2_0106FDC0
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01069C20 13_2_01069C20
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010C9C32 13_2_010C9C32
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01051F92 13_2_01051F92
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01059EB0 13_2_01059EB0
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe B600C43E2980691952532A79E7A0AEF2351AEEF6F740FD2F56647509C93B6DA0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: String function: 01635130 appears 58 times
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: String function: 0166EA12 appears 86 times
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: String function: 01647E54 appears 99 times
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: String function: 0167F290 appears 103 times
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: String function: 015EB970 appears 262 times
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: String function: 01097E54 appears 96 times
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: String function: 010BEA12 appears 36 times
PE / OLE file has an invalid certificate
Source: FGGx944Qu7.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: FGGx944Qu7.exe, 00000000.00000002.1690219272.0000000004019000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs FGGx944Qu7.exe
Source: FGGx944Qu7.exe, 00000000.00000002.1681935621.000000000130E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs FGGx944Qu7.exe
Source: FGGx944Qu7.exe, 00000000.00000002.1690219272.0000000004A0A000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs FGGx944Qu7.exe
Source: FGGx944Qu7.exe, 00000000.00000002.1693048544.00000000056A0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameSimpleLogin.dll8 vs FGGx944Qu7.exe
Source: FGGx944Qu7.exe, 00000000.00000002.1684136801.0000000002DA0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs FGGx944Qu7.exe
Source: FGGx944Qu7.exe, 00000008.00000002.1946419926.00000000016ED000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs FGGx944Qu7.exe
Source: FGGx944Qu7.exe Binary or memory string: OriginalFilenameQbmX.exen' vs FGGx944Qu7.exe
Uses 32bit PE files
Source: FGGx944Qu7.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 8.2.FGGx944Qu7.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 8.2.FGGx944Qu7.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.2863758312.0000000003070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.2861231272.0000000002A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1946159228.0000000001510000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1945331228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000010.00000002.2863668034.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000D.00000002.2030469230.0000000000417000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0000000F.00000002.2863047851.0000000004760000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000008.00000002.1948193173.0000000003810000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: FGGx944Qu7.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: TBsjWljiCpR.exe.0.dr Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, st1dsKfLn6u0rMPrYT.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, st1dsKfLn6u0rMPrYT.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: _0020.SetAccessControl
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: _0020.AddAccessRule
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, st1dsKfLn6u0rMPrYT.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, st1dsKfLn6u0rMPrYT.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, st1dsKfLn6u0rMPrYT.cs Security API names: System.Security.Principal.WindowsPrincipal.IsInRole(System.Security.Principal.WindowsBuiltInRole)
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, st1dsKfLn6u0rMPrYT.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: _0020.SetAccessControl
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: _0020.AddAccessRule
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: _0020.SetAccessControl
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, KIEnU8WvlckDlH11VR.cs Security API names: _0020.AddAccessRule
Source: 0.2.FGGx944Qu7.exe.304eefc.2.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.FGGx944Qu7.exe.56f0000.9.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 9.2.TBsjWljiCpR.exe.3114428.1.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: 0.2.FGGx944Qu7.exe.303eee4.1.raw.unpack, ReactionVessel.cs Suspicious method names: .ReactionVessel.Inject
Source: classification engine Classification label: mal100.troj.spyw.evad.winEXE@25/16@6/3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe File created: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Mutant created: \Sessions\1\BaseNamedObjects\JCxudnFAElK
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7416:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7480:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7872:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7352:120:WilError_03
Source: C:\Users\user\Desktop\FGGx944Qu7.exe File created: C:\Users\user\AppData\Local\Temp\tmp1454.tmp Jump to behavior
Source: FGGx944Qu7.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: FGGx944Qu7.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 50.01%
Source: C:\Users\user\Desktop\FGGx944Qu7.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SearchProtocolHost.exe, 00000010.00000003.2407226504.0000000002D07000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.2407458441.0000000002D28000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002D28000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: CREATE TABLE password_notes (id INTEGER PRIMARY KEY AUTOINCREMENT, parent_id INTEGER NOT NULL REFERENCES logins ON UPDATE CASCADE ON DELETE CASCADE DEFERRABLE INITIALLY DEFERRED, key VARCHAR NOT NULL, value BLOB, date_created INTEGER NOT NULL, confidential INTEGER, UNIQUE (parent_id, key));
Source: FGGx944Qu7.exe ReversingLabs: Detection: 62%
Source: FGGx944Qu7.exe Virustotal: Detection: 67%
Source: C:\Users\user\Desktop\FGGx944Qu7.exe File read: C:\Users\user\Desktop\FGGx944Qu7.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\FGGx944Qu7.exe "C:\Users\user\Desktop\FGGx944Qu7.exe"
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FGGx944Qu7.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TBsjWljiCpR" /XML "C:\Users\user\AppData\Local\Temp\tmp1454.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Users\user\Desktop\FGGx944Qu7.exe "C:\Users\user\Desktop\FGGx944Qu7.exe"
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Users\user\Desktop\FGGx944Qu7.exe "C:\Users\user\Desktop\FGGx944Qu7.exe"
Source: unknown Process created: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TBsjWljiCpR" /XML "C:\Users\user\AppData\Local\Temp\tmp350B.tmp"
Source: C:\Windows\SysWOW64\schtasks.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process created: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe "C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe"
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Process created: C:\Windows\SysWOW64\SearchProtocolHost.exe "C:\Windows\SysWOW64\SearchProtocolHost.exe"
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FGGx944Qu7.exe" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TBsjWljiCpR" /XML "C:\Users\user\AppData\Local\Temp\tmp1454.tmp" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Users\user\Desktop\FGGx944Qu7.exe "C:\Users\user\Desktop\FGGx944Qu7.exe" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Users\user\Desktop\FGGx944Qu7.exe "C:\Users\user\Desktop\FGGx944Qu7.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TBsjWljiCpR" /XML "C:\Users\user\AppData\Local\Temp\tmp350B.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process created: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe "C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe" Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Process created: C:\Windows\SysWOW64\SearchProtocolHost.exe "C:\Windows\SysWOW64\SearchProtocolHost.exe" Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: taskschd.dll Jump to behavior
Source: C:\Windows\SysWOW64\schtasks.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: tquery.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: cryptdll.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: ieframe.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: netapi32.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: mlang.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: winsqlite3.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: vaultcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Section loaded: wininet.dll
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Section loaded: mswsock.dll
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Section loaded: dnsapi.dll
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Section loaded: iphlpapi.dll
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Section loaded: fwpuclnt.dll
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Section loaded: rasadhlp.dll
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\FGGx944Qu7.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\15.0\Outlook\Profiles\Outlook\ Jump to behavior
Source: FGGx944Qu7.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: FGGx944Qu7.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: R:\JoeSecurity\trunk\src\windows\usermode\tools\FakeChrome\Release\Chrome.pdb source: usFxdnRPYjnb.exe, 0000000F.00000000.1869462009.0000000000FAE000.00000002.00000001.01000000.0000000A.sdmp, usFxdnRPYjnb.exe, 00000013.00000000.2032183269.0000000000FAE000.00000002.00000001.01000000.0000000A.sdmp
Source: Binary string: wntdll.pdbUGP source: FGGx944Qu7.exe, 00000008.00000002.1946419926.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.1947640704.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2864118086.000000000342E000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.1945593903.0000000002F32000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2864118086.0000000003290000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: FGGx944Qu7.exe, FGGx944Qu7.exe, 00000008.00000002.1946419926.00000000015C0000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.1947640704.00000000030E9000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2864118086.000000000342E000.00000040.00001000.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000003.1945593903.0000000002F32000.00000004.00000020.00020000.00000000.sdmp, SearchProtocolHost.exe, 00000010.00000002.2864118086.0000000003290000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: SearchProtocolHost.pdbUGP source: usFxdnRPYjnb.exe, 0000000F.00000003.1884595652.0000000000C8B000.00000004.00000001.00020000.00000000.sdmp
Source: Binary string: SearchProtocolHost.pdb source: usFxdnRPYjnb.exe, 0000000F.00000003.1884595652.0000000000C8B000.00000004.00000001.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains method to dynamically call methods (often used by packers)
Source: FGGx944Qu7.exe, Form1.cs .Net Code: LateBinding.LateCall((object)methodInfo, (Type)null, "Invoke", new object[2]{0,new string[3]{EIK[0],EIK[1],"EmuLister"}}, (string[])null, (bool[])null)
Source: TBsjWljiCpR.exe.0.dr, Form1.cs .Net Code: LateBinding.LateCall((object)methodInfo, (Type)null, "Invoke", new object[2]{0,new string[3]{EIK[0],EIK[1],"EmuLister"}}, (string[])null, (bool[])null)
.NET source code contains potential unpacker
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, KIEnU8WvlckDlH11VR.cs .Net Code: Obi6Qd2fZa System.Reflection.Assembly.Load(byte[])
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, KIEnU8WvlckDlH11VR.cs .Net Code: Obi6Qd2fZa System.Reflection.Assembly.Load(byte[])
Source: 0.2.FGGx944Qu7.exe.4019970.6.raw.unpack, LoginForm.cs .Net Code: _200E_202E_200D_206C_202E_206B_200C_200E_206F_206F_202A_206E_202D_206B_206F_202A_202A_206C_206C_200C_206B_206E_202A_206D_200D_202B_200F_206A_202E_200B_202A_202E_202B_202C_200C_202A_206C_202A_206B_200E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, KIEnU8WvlckDlH11VR.cs .Net Code: Obi6Qd2fZa System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0041E15D push FFFFFFB6h; retf 8_2_0041E191
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0041E19F push FFFFFFB6h; retf 8_2_0041E191
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00416234 pushfd ; iretd 8_2_0041624C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00407A3A push ebx; iretd 8_2_00407A3C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00401A3D push ds; ret 8_2_00401A51
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_004162B5 push edi; iretd 8_2_004162C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040CB07 push edi; retf 8_2_0040CB08
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0041838B push cs; retf 8_2_0041838C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040CD7A push ss; iretd 8_2_0040CD8C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00403500 push eax; ret 8_2_00403502
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040AD09 push edx; ret 8_2_0040AD0A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00413D36 push esp; retf 8_2_00413D3F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00401D80 push 720ECF9Eh; iretd 8_2_0040224B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0040DF0F push edx; iretd 8_2_0040DF10
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F09AD push ecx; mov dword ptr [esp], ecx 8_2_015F09B6
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0108C54D pushfd ; ret 13_2_0108C54E
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0108C54F push 8B010167h; ret 13_2_0108C554
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_010409AD push ecx; mov dword ptr [esp], ecx 13_2_010409B6
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0108C9D7 push edi; ret 13_2_0108C9D9
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01011200 push eax; iretd 13_2_01011369
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01011FEC push eax; iretd 13_2_01011FED
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_01097E99 push ecx; ret 13_2_01097EAC
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_00418294 push edi; iretd 13_2_00418296
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Code function: 13_2_0041838B push cs; retf 13_2_0041838C
Source: FGGx944Qu7.exe Static PE information: section name: .text entropy: 7.9850458366692925
Source: TBsjWljiCpR.exe.0.dr Static PE information: section name: .text entropy: 7.9850458366692925
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, zKu78MpLNKf7oMfFQh.cs High entropy of concatenated method names: 'yeEQPBAjg', 'X8rvMF6Ep', 'cXpxLJYUn', 'ekmFhobN0', 'nZoUU0BmC', 'LUOemm62k', 'dOMmVJn131lsq4GBja', 'wkMs46VtcHyKn2fHwc', 'LCNBBGv1J', 'A7QH9iFdN'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, M6TMA9J6gECMJj4ypu.cs High entropy of concatenated method names: 'doRXKcbtXo', 'woYXEbw58o', 'dsXXQ888a4', 'uCnXvcSHxB', 'bHyXijm4WS', 'VkVXxcyC0l', 'VjPXF44amU', 'XSkXfNVVvQ', 'if9XUPkPVC', 'sh0XeheUWS'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, QOde30UoOmhXIIPqmZ.cs High entropy of concatenated method names: 'echkvafM7K', 'PYUkxMtIdk', 'vBvkfueFr6', 't02kU4m03H', 'vEikyUpIgN', 'BqAkLZyP2d', 'Hyikcqc8eW', 'BRQkBaeGUC', 'PZSk0AhjOH', 'f6HkHpdb6m'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, zhqWUhjaUqjYNr08Sp.cs High entropy of concatenated method names: 'u5IGN58ckU', 'QXtGdCVlse', 'QHbGqAqx9f', 'BJEGXq6g1D', 'TAdGWyx7v5', 'ivpqSIkP28', 'ucPqttf7UQ', 'fn4qmhaHiQ', 'OAmq1VFtIG', 'ln5qPsdVB6'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, FJg6Wv5509ZXydNFOJB.cs High entropy of concatenated method names: 'ToString', 'qMNHVnp9qv', 'pg7H6ckmkc', 'hxJHNRs6Zo', 'WZ2HCosg5b', 'PYRHdeiM6T', 'QDWHkw4ILT', 'WBeHqIXAMf', 'a5KbLU5g2ngujc1ploh', 'MRbi1M5PkMlhtTfA0a3'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, g8X498eSB4ZM9pdKy6.cs High entropy of concatenated method names: 'zlbqi3QpOm', 'NegqFviFwF', 'OkbkOg4K27', 'xPBksdrOSx', 'd74k40AJ20', 'EJikl6jOZE', 'sBckTxAhVH', 'iFrkoWP90w', 'FDwkJqaov0', 'Rw6k8wauhX'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, Ar0ZDZ6hqqFCb9tOPE.cs High entropy of concatenated method names: 'XtH5Xt1dsK', 'pn65Wu0rMP', 'roO5RmhXII', 'Xqm5IZd8X4', 'bdK5yy6Qhq', 'kUh5LaUqjY', 'WKY1Qp4Z8fdqwcZ4ri', 'KNK9E6Bd27TgPnLq9j', 'BlT55Kff4U', 'So45VfspTM'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, st1dsKfLn6u0rMPrYT.cs High entropy of concatenated method names: 'I3Kdw3g150', 'uexd7mliXD', 'whSdgJ1oAp', 'DQSd2cT6O6', 'AQNdSpj4fS', 'CYIdt11qX7', 'HVOdmyR3PA', 'WCpd1EQFFS', 'NZNdPp9t1q', 'wSfdnoB3b5'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, oAl2Hsksxhxi2EQuvF.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'm7upPowGcr', 'SYhpntuoc4', 'iqipz9SZQq', 'kToVa6QNZn', 'cZAV5WFplw', 'B7NVpbHNLy', 'a76VVj3UBp', 'dE7jdXM7bZgLD7bGaR5'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, ekkkRe5aIZpAd5pcdRK.cs High entropy of concatenated method names: 'X8H0KPh6n4', 'Uri0E2Z2xj', 'JjE0QnxtH3', 'Bqq0vDVyG0', 'Ef50ihh1ZS', 'MaK0x21pQZ', 'fgj0FB5Y2e', 'h5c0fiSvG5', 'D4C0U03BYl', 'Aug0eF1otW'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, Qvw5fqTaMwD3qUIH41.cs High entropy of concatenated method names: 'QmgXC0Stte', 'ojAXk9hbcs', 'mIjXGHoyFc', 'aJkGnWLQQG', 'aFqGzD8rQX', 'HJeXaLxlx1', 'ea0X58dTob', 'rj4XpI2DTK', 'SAPXVYPYn3', 'svPX6WSS3E'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, skeHuy1OknjT7QIR5Y.cs High entropy of concatenated method names: 'GrXBCYRIOc', 'bJYBdHg5MK', 'KSWBkGoTQW', 'BdlBqYbqdr', 'CFLBGxN0gY', 'q9eBX7sOI7', 'WplBWtrqR3', 'n5MBMZqYV1', 'nHDBRiP0e9', 'yvcBIoeZH4'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, FSJ5wAg9wfpjNbAye6.cs High entropy of concatenated method names: 'ToString', 'spcLAmqiqK', 'DmcLbNf3tP', 'PBdLOlFOkv', 'GCTLswWEUn', 'wJOL45S6aZ', 'uS6LlPOK11', 'ds6LTN9LwR', 'jn4LofsUll', 'piHLJo1lpZ'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, lbGCkp5Vtsla7QGfDKN.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PZRHwnYtNy', 'w4IH7FSqR3', 'qW1HgKTwuW', 'ryKH2hDybW', 'Hq4HSoPUva', 'x1QHtO0Ncs', 'SrSHmAOMMF'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, w3EmhdtvZnNN1x7nyF.cs High entropy of concatenated method names: 'WkDc1uLJgc', 'D1UcnacmU7', 'TOEBaqcGJb', 'dxdB5fQgFc', 'h9vcAEWirC', 'wVDcr2PLsT', 'oAJcu2uc66', 'LY0cwNOY4D', 'QNZc7SBA5b', 'CTycgvaonE'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, KIEnU8WvlckDlH11VR.cs High entropy of concatenated method names: 'SRxVNVrHlT', 'peRVCPk3Wl', 'lPbVdXmFn2', 'tqTVkPwCVo', 'oBGVqNUlo6', 'bR8VGVXSXD', 'CPXVXyAnek', 'UWpVWjpeMA', 'f1YVM6gqg9', 'XHmVRYALue'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, IWRIt7dVO6ncMTHeUD.cs High entropy of concatenated method names: 'Dispose', 'Tyf5PUNq7a', 'qCjpb2JBH5', 'H2VaaPf3UT', 'AHk5neHuyO', 'hnj5zT7QIR', 'ProcessDialogKey', 'bY3paSJ6Gs', 'xxQp50NQir', 'miapp0nRUh'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, Ujy13luVt5WqpjICm0.cs High entropy of concatenated method names: 'sdM9flVgIF', 'rGG9UhdtQg', 'xWs9jKRETn', 'Suy9bOxO7w', 'Emj9sg51A9', 'q3j94OKQb4', 'DZ59TGyCat', 'HaG9oioJiP', 'JZO98Hjugl', 'IpP9Al8ssc'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, snRUh1niwQbHI6M83f.cs High entropy of concatenated method names: 'IPi051uMRM', 'DXk0VEGfOA', 'tgZ06uEMGr', 'kJ10CenKXy', 'NFv0dsPFuL', 'ByD0qOniSH', 'sSD0GZ3YpW', 'qArBmoExny', 'PSNB1Kv8sQ', 'pMCBP2QZ8X'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, xSHtdkwgAmsVjQEvL2.cs High entropy of concatenated method names: 'DiFy8OgaDD', 'beeyrGufcw', 'gW9ywWJ2Xs', 'Dcky7X8ARo', 'KvdybBm3et', 'vOhyOfTPwI', 'AvtysaNuE5', 'S0yy4CX3QP', 'l0vyli1GvU', 'dvHyTZNj2d'
Source: 0.2.FGGx944Qu7.exe.4c2eeb0.4.raw.unpack, eUYxAsz7f1gqDsK0ZX.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'i5N09msF41', 'N7c0yi1WaF', 'PmX0LoqPmc', 'ekR0cJMyer', 'ovB0BhXKIe', 'JTI00NTL71', 'xJy0HY7bKa'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, zKu78MpLNKf7oMfFQh.cs High entropy of concatenated method names: 'yeEQPBAjg', 'X8rvMF6Ep', 'cXpxLJYUn', 'ekmFhobN0', 'nZoUU0BmC', 'LUOemm62k', 'dOMmVJn131lsq4GBja', 'wkMs46VtcHyKn2fHwc', 'LCNBBGv1J', 'A7QH9iFdN'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, M6TMA9J6gECMJj4ypu.cs High entropy of concatenated method names: 'doRXKcbtXo', 'woYXEbw58o', 'dsXXQ888a4', 'uCnXvcSHxB', 'bHyXijm4WS', 'VkVXxcyC0l', 'VjPXF44amU', 'XSkXfNVVvQ', 'if9XUPkPVC', 'sh0XeheUWS'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, QOde30UoOmhXIIPqmZ.cs High entropy of concatenated method names: 'echkvafM7K', 'PYUkxMtIdk', 'vBvkfueFr6', 't02kU4m03H', 'vEikyUpIgN', 'BqAkLZyP2d', 'Hyikcqc8eW', 'BRQkBaeGUC', 'PZSk0AhjOH', 'f6HkHpdb6m'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, zhqWUhjaUqjYNr08Sp.cs High entropy of concatenated method names: 'u5IGN58ckU', 'QXtGdCVlse', 'QHbGqAqx9f', 'BJEGXq6g1D', 'TAdGWyx7v5', 'ivpqSIkP28', 'ucPqttf7UQ', 'fn4qmhaHiQ', 'OAmq1VFtIG', 'ln5qPsdVB6'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, FJg6Wv5509ZXydNFOJB.cs High entropy of concatenated method names: 'ToString', 'qMNHVnp9qv', 'pg7H6ckmkc', 'hxJHNRs6Zo', 'WZ2HCosg5b', 'PYRHdeiM6T', 'QDWHkw4ILT', 'WBeHqIXAMf', 'a5KbLU5g2ngujc1ploh', 'MRbi1M5PkMlhtTfA0a3'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, g8X498eSB4ZM9pdKy6.cs High entropy of concatenated method names: 'zlbqi3QpOm', 'NegqFviFwF', 'OkbkOg4K27', 'xPBksdrOSx', 'd74k40AJ20', 'EJikl6jOZE', 'sBckTxAhVH', 'iFrkoWP90w', 'FDwkJqaov0', 'Rw6k8wauhX'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, Ar0ZDZ6hqqFCb9tOPE.cs High entropy of concatenated method names: 'XtH5Xt1dsK', 'pn65Wu0rMP', 'roO5RmhXII', 'Xqm5IZd8X4', 'bdK5yy6Qhq', 'kUh5LaUqjY', 'WKY1Qp4Z8fdqwcZ4ri', 'KNK9E6Bd27TgPnLq9j', 'BlT55Kff4U', 'So45VfspTM'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, st1dsKfLn6u0rMPrYT.cs High entropy of concatenated method names: 'I3Kdw3g150', 'uexd7mliXD', 'whSdgJ1oAp', 'DQSd2cT6O6', 'AQNdSpj4fS', 'CYIdt11qX7', 'HVOdmyR3PA', 'WCpd1EQFFS', 'NZNdPp9t1q', 'wSfdnoB3b5'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, oAl2Hsksxhxi2EQuvF.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'm7upPowGcr', 'SYhpntuoc4', 'iqipz9SZQq', 'kToVa6QNZn', 'cZAV5WFplw', 'B7NVpbHNLy', 'a76VVj3UBp', 'dE7jdXM7bZgLD7bGaR5'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, ekkkRe5aIZpAd5pcdRK.cs High entropy of concatenated method names: 'X8H0KPh6n4', 'Uri0E2Z2xj', 'JjE0QnxtH3', 'Bqq0vDVyG0', 'Ef50ihh1ZS', 'MaK0x21pQZ', 'fgj0FB5Y2e', 'h5c0fiSvG5', 'D4C0U03BYl', 'Aug0eF1otW'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, Qvw5fqTaMwD3qUIH41.cs High entropy of concatenated method names: 'QmgXC0Stte', 'ojAXk9hbcs', 'mIjXGHoyFc', 'aJkGnWLQQG', 'aFqGzD8rQX', 'HJeXaLxlx1', 'ea0X58dTob', 'rj4XpI2DTK', 'SAPXVYPYn3', 'svPX6WSS3E'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, skeHuy1OknjT7QIR5Y.cs High entropy of concatenated method names: 'GrXBCYRIOc', 'bJYBdHg5MK', 'KSWBkGoTQW', 'BdlBqYbqdr', 'CFLBGxN0gY', 'q9eBX7sOI7', 'WplBWtrqR3', 'n5MBMZqYV1', 'nHDBRiP0e9', 'yvcBIoeZH4'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, FSJ5wAg9wfpjNbAye6.cs High entropy of concatenated method names: 'ToString', 'spcLAmqiqK', 'DmcLbNf3tP', 'PBdLOlFOkv', 'GCTLswWEUn', 'wJOL45S6aZ', 'uS6LlPOK11', 'ds6LTN9LwR', 'jn4LofsUll', 'piHLJo1lpZ'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, lbGCkp5Vtsla7QGfDKN.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PZRHwnYtNy', 'w4IH7FSqR3', 'qW1HgKTwuW', 'ryKH2hDybW', 'Hq4HSoPUva', 'x1QHtO0Ncs', 'SrSHmAOMMF'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, w3EmhdtvZnNN1x7nyF.cs High entropy of concatenated method names: 'WkDc1uLJgc', 'D1UcnacmU7', 'TOEBaqcGJb', 'dxdB5fQgFc', 'h9vcAEWirC', 'wVDcr2PLsT', 'oAJcu2uc66', 'LY0cwNOY4D', 'QNZc7SBA5b', 'CTycgvaonE'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, KIEnU8WvlckDlH11VR.cs High entropy of concatenated method names: 'SRxVNVrHlT', 'peRVCPk3Wl', 'lPbVdXmFn2', 'tqTVkPwCVo', 'oBGVqNUlo6', 'bR8VGVXSXD', 'CPXVXyAnek', 'UWpVWjpeMA', 'f1YVM6gqg9', 'XHmVRYALue'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, IWRIt7dVO6ncMTHeUD.cs High entropy of concatenated method names: 'Dispose', 'Tyf5PUNq7a', 'qCjpb2JBH5', 'H2VaaPf3UT', 'AHk5neHuyO', 'hnj5zT7QIR', 'ProcessDialogKey', 'bY3paSJ6Gs', 'xxQp50NQir', 'miapp0nRUh'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, Ujy13luVt5WqpjICm0.cs High entropy of concatenated method names: 'sdM9flVgIF', 'rGG9UhdtQg', 'xWs9jKRETn', 'Suy9bOxO7w', 'Emj9sg51A9', 'q3j94OKQb4', 'DZ59TGyCat', 'HaG9oioJiP', 'JZO98Hjugl', 'IpP9Al8ssc'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, snRUh1niwQbHI6M83f.cs High entropy of concatenated method names: 'IPi051uMRM', 'DXk0VEGfOA', 'tgZ06uEMGr', 'kJ10CenKXy', 'NFv0dsPFuL', 'ByD0qOniSH', 'sSD0GZ3YpW', 'qArBmoExny', 'PSNB1Kv8sQ', 'pMCBP2QZ8X'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, xSHtdkwgAmsVjQEvL2.cs High entropy of concatenated method names: 'DiFy8OgaDD', 'beeyrGufcw', 'gW9ywWJ2Xs', 'Dcky7X8ARo', 'KvdybBm3et', 'vOhyOfTPwI', 'AvtysaNuE5', 'S0yy4CX3QP', 'l0vyli1GvU', 'dvHyTZNj2d'
Source: 0.2.FGGx944Qu7.exe.2da0000.0.raw.unpack, eUYxAsz7f1gqDsK0ZX.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'i5N09msF41', 'N7c0yi1WaF', 'PmX0LoqPmc', 'ekR0cJMyer', 'ovB0BhXKIe', 'JTI00NTL71', 'xJy0HY7bKa'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, zKu78MpLNKf7oMfFQh.cs High entropy of concatenated method names: 'yeEQPBAjg', 'X8rvMF6Ep', 'cXpxLJYUn', 'ekmFhobN0', 'nZoUU0BmC', 'LUOemm62k', 'dOMmVJn131lsq4GBja', 'wkMs46VtcHyKn2fHwc', 'LCNBBGv1J', 'A7QH9iFdN'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, M6TMA9J6gECMJj4ypu.cs High entropy of concatenated method names: 'doRXKcbtXo', 'woYXEbw58o', 'dsXXQ888a4', 'uCnXvcSHxB', 'bHyXijm4WS', 'VkVXxcyC0l', 'VjPXF44amU', 'XSkXfNVVvQ', 'if9XUPkPVC', 'sh0XeheUWS'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, QOde30UoOmhXIIPqmZ.cs High entropy of concatenated method names: 'echkvafM7K', 'PYUkxMtIdk', 'vBvkfueFr6', 't02kU4m03H', 'vEikyUpIgN', 'BqAkLZyP2d', 'Hyikcqc8eW', 'BRQkBaeGUC', 'PZSk0AhjOH', 'f6HkHpdb6m'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, zhqWUhjaUqjYNr08Sp.cs High entropy of concatenated method names: 'u5IGN58ckU', 'QXtGdCVlse', 'QHbGqAqx9f', 'BJEGXq6g1D', 'TAdGWyx7v5', 'ivpqSIkP28', 'ucPqttf7UQ', 'fn4qmhaHiQ', 'OAmq1VFtIG', 'ln5qPsdVB6'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, FJg6Wv5509ZXydNFOJB.cs High entropy of concatenated method names: 'ToString', 'qMNHVnp9qv', 'pg7H6ckmkc', 'hxJHNRs6Zo', 'WZ2HCosg5b', 'PYRHdeiM6T', 'QDWHkw4ILT', 'WBeHqIXAMf', 'a5KbLU5g2ngujc1ploh', 'MRbi1M5PkMlhtTfA0a3'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, g8X498eSB4ZM9pdKy6.cs High entropy of concatenated method names: 'zlbqi3QpOm', 'NegqFviFwF', 'OkbkOg4K27', 'xPBksdrOSx', 'd74k40AJ20', 'EJikl6jOZE', 'sBckTxAhVH', 'iFrkoWP90w', 'FDwkJqaov0', 'Rw6k8wauhX'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, Ar0ZDZ6hqqFCb9tOPE.cs High entropy of concatenated method names: 'XtH5Xt1dsK', 'pn65Wu0rMP', 'roO5RmhXII', 'Xqm5IZd8X4', 'bdK5yy6Qhq', 'kUh5LaUqjY', 'WKY1Qp4Z8fdqwcZ4ri', 'KNK9E6Bd27TgPnLq9j', 'BlT55Kff4U', 'So45VfspTM'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, st1dsKfLn6u0rMPrYT.cs High entropy of concatenated method names: 'I3Kdw3g150', 'uexd7mliXD', 'whSdgJ1oAp', 'DQSd2cT6O6', 'AQNdSpj4fS', 'CYIdt11qX7', 'HVOdmyR3PA', 'WCpd1EQFFS', 'NZNdPp9t1q', 'wSfdnoB3b5'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, oAl2Hsksxhxi2EQuvF.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'm7upPowGcr', 'SYhpntuoc4', 'iqipz9SZQq', 'kToVa6QNZn', 'cZAV5WFplw', 'B7NVpbHNLy', 'a76VVj3UBp', 'dE7jdXM7bZgLD7bGaR5'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, ekkkRe5aIZpAd5pcdRK.cs High entropy of concatenated method names: 'X8H0KPh6n4', 'Uri0E2Z2xj', 'JjE0QnxtH3', 'Bqq0vDVyG0', 'Ef50ihh1ZS', 'MaK0x21pQZ', 'fgj0FB5Y2e', 'h5c0fiSvG5', 'D4C0U03BYl', 'Aug0eF1otW'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, Qvw5fqTaMwD3qUIH41.cs High entropy of concatenated method names: 'QmgXC0Stte', 'ojAXk9hbcs', 'mIjXGHoyFc', 'aJkGnWLQQG', 'aFqGzD8rQX', 'HJeXaLxlx1', 'ea0X58dTob', 'rj4XpI2DTK', 'SAPXVYPYn3', 'svPX6WSS3E'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, skeHuy1OknjT7QIR5Y.cs High entropy of concatenated method names: 'GrXBCYRIOc', 'bJYBdHg5MK', 'KSWBkGoTQW', 'BdlBqYbqdr', 'CFLBGxN0gY', 'q9eBX7sOI7', 'WplBWtrqR3', 'n5MBMZqYV1', 'nHDBRiP0e9', 'yvcBIoeZH4'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, FSJ5wAg9wfpjNbAye6.cs High entropy of concatenated method names: 'ToString', 'spcLAmqiqK', 'DmcLbNf3tP', 'PBdLOlFOkv', 'GCTLswWEUn', 'wJOL45S6aZ', 'uS6LlPOK11', 'ds6LTN9LwR', 'jn4LofsUll', 'piHLJo1lpZ'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, lbGCkp5Vtsla7QGfDKN.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'PZRHwnYtNy', 'w4IH7FSqR3', 'qW1HgKTwuW', 'ryKH2hDybW', 'Hq4HSoPUva', 'x1QHtO0Ncs', 'SrSHmAOMMF'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, w3EmhdtvZnNN1x7nyF.cs High entropy of concatenated method names: 'WkDc1uLJgc', 'D1UcnacmU7', 'TOEBaqcGJb', 'dxdB5fQgFc', 'h9vcAEWirC', 'wVDcr2PLsT', 'oAJcu2uc66', 'LY0cwNOY4D', 'QNZc7SBA5b', 'CTycgvaonE'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, KIEnU8WvlckDlH11VR.cs High entropy of concatenated method names: 'SRxVNVrHlT', 'peRVCPk3Wl', 'lPbVdXmFn2', 'tqTVkPwCVo', 'oBGVqNUlo6', 'bR8VGVXSXD', 'CPXVXyAnek', 'UWpVWjpeMA', 'f1YVM6gqg9', 'XHmVRYALue'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, IWRIt7dVO6ncMTHeUD.cs High entropy of concatenated method names: 'Dispose', 'Tyf5PUNq7a', 'qCjpb2JBH5', 'H2VaaPf3UT', 'AHk5neHuyO', 'hnj5zT7QIR', 'ProcessDialogKey', 'bY3paSJ6Gs', 'xxQp50NQir', 'miapp0nRUh'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, Ujy13luVt5WqpjICm0.cs High entropy of concatenated method names: 'sdM9flVgIF', 'rGG9UhdtQg', 'xWs9jKRETn', 'Suy9bOxO7w', 'Emj9sg51A9', 'q3j94OKQb4', 'DZ59TGyCat', 'HaG9oioJiP', 'JZO98Hjugl', 'IpP9Al8ssc'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, snRUh1niwQbHI6M83f.cs High entropy of concatenated method names: 'IPi051uMRM', 'DXk0VEGfOA', 'tgZ06uEMGr', 'kJ10CenKXy', 'NFv0dsPFuL', 'ByD0qOniSH', 'sSD0GZ3YpW', 'qArBmoExny', 'PSNB1Kv8sQ', 'pMCBP2QZ8X'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, xSHtdkwgAmsVjQEvL2.cs High entropy of concatenated method names: 'DiFy8OgaDD', 'beeyrGufcw', 'gW9ywWJ2Xs', 'Dcky7X8ARo', 'KvdybBm3et', 'vOhyOfTPwI', 'AvtysaNuE5', 'S0yy4CX3QP', 'l0vyli1GvU', 'dvHyTZNj2d'
Source: 0.2.FGGx944Qu7.exe.4cb28d0.5.raw.unpack, eUYxAsz7f1gqDsK0ZX.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'i5N09msF41', 'N7c0yi1WaF', 'PmX0LoqPmc', 'ekR0cJMyer', 'ovB0BhXKIe', 'JTI00NTL71', 'xJy0HY7bKa'
Drops PE files
Source: C:\Users\user\Desktop\FGGx944Qu7.exe File created: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Jump to dropped file

Boot Survival
barindex
Uses schtasks.exe or at.exe to add and modify task schedules
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TBsjWljiCpR" /XML "C:\Users\user\AppData\Local\Temp\tmp1454.tmp"

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Stores large binary data to the registry
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Key value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 Blob Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: FGGx944Qu7.exe PID: 7252, type: MEMORYSTR
Source: Yara match File source: Process Memory Space: TBsjWljiCpR.exe PID: 7680, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 15E0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 3010000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 2DA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 6290000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 7290000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 73C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 83C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 8620000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: 9620000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: A620000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: B620000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: C270000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: D270000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: E270000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 1610000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 3090000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 2EA0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 6150000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 7150000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 7280000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 8280000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 84D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 94D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 7280000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 84D0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory allocated: 94D0000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0163096E rdtsc 8_2_0163096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5555 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5875 Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Window / User API: threadDelayed 2042
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Window / User API: threadDelayed 7930
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\FGGx944Qu7.exe API coverage: 0.7 %
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe API coverage: 0.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\FGGx944Qu7.exe TID: 7272 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7488 Thread sleep count: 5555 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7660 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7476 Thread sleep count: 194 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7596 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7664 Thread sleep time: -4611686018427385s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7612 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe TID: 7804 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe TID: 1072 Thread sleep count: 2042 > 30
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe TID: 1072 Thread sleep time: -4084000s >= -30000s
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe TID: 1072 Thread sleep count: 7930 > 30
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe TID: 1072 Thread sleep time: -15860000s >= -30000s
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: usFxdnRPYjnb.exe, 00000013.00000002.2863023876.00000000012A9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllv
Source: firefox.exe, 00000014.00000002.2544008849.00000282D43FB000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dll::k
Source: SearchProtocolHost.exe, 00000010.00000002.2861704958.0000000002CB9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllO&i
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process queried: DebugPort
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0163096E rdtsc 8_2_0163096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_00417393 LdrLoadDll, 8_2_00417393
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EC156 mov eax, dword ptr fs:[00000030h] 8_2_015EC156
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6154 mov eax, dword ptr fs:[00000030h] 8_2_015F6154
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6154 mov eax, dword ptr fs:[00000030h] 8_2_015F6154
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01684144 mov eax, dword ptr fs:[00000030h] 8_2_01684144
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01684144 mov eax, dword ptr fs:[00000030h] 8_2_01684144
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01684144 mov ecx, dword ptr fs:[00000030h] 8_2_01684144
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01684144 mov eax, dword ptr fs:[00000030h] 8_2_01684144
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01684144 mov eax, dword ptr fs:[00000030h] 8_2_01684144
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01688158 mov eax, dword ptr fs:[00000030h] 8_2_01688158
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01620124 mov eax, dword ptr fs:[00000030h] 8_2_01620124
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov eax, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov ecx, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov eax, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov eax, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov ecx, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov eax, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov eax, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov ecx, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov eax, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E10E mov ecx, dword ptr fs:[00000030h] 8_2_0169E10E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169A118 mov ecx, dword ptr fs:[00000030h] 8_2_0169A118
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169A118 mov eax, dword ptr fs:[00000030h] 8_2_0169A118
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169A118 mov eax, dword ptr fs:[00000030h] 8_2_0169A118
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169A118 mov eax, dword ptr fs:[00000030h] 8_2_0169A118
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B0115 mov eax, dword ptr fs:[00000030h] 8_2_016B0115
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C61E5 mov eax, dword ptr fs:[00000030h] 8_2_016C61E5
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016201F8 mov eax, dword ptr fs:[00000030h] 8_2_016201F8
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B61C3 mov eax, dword ptr fs:[00000030h] 8_2_016B61C3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B61C3 mov eax, dword ptr fs:[00000030h] 8_2_016B61C3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E1D0 mov eax, dword ptr fs:[00000030h] 8_2_0166E1D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E1D0 mov eax, dword ptr fs:[00000030h] 8_2_0166E1D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E1D0 mov ecx, dword ptr fs:[00000030h] 8_2_0166E1D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E1D0 mov eax, dword ptr fs:[00000030h] 8_2_0166E1D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E1D0 mov eax, dword ptr fs:[00000030h] 8_2_0166E1D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EA197 mov eax, dword ptr fs:[00000030h] 8_2_015EA197
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EA197 mov eax, dword ptr fs:[00000030h] 8_2_015EA197
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EA197 mov eax, dword ptr fs:[00000030h] 8_2_015EA197
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AC188 mov eax, dword ptr fs:[00000030h] 8_2_016AC188
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AC188 mov eax, dword ptr fs:[00000030h] 8_2_016AC188
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01630185 mov eax, dword ptr fs:[00000030h] 8_2_01630185
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01694180 mov eax, dword ptr fs:[00000030h] 8_2_01694180
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01694180 mov eax, dword ptr fs:[00000030h] 8_2_01694180
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167019F mov eax, dword ptr fs:[00000030h] 8_2_0167019F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167019F mov eax, dword ptr fs:[00000030h] 8_2_0167019F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167019F mov eax, dword ptr fs:[00000030h] 8_2_0167019F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167019F mov eax, dword ptr fs:[00000030h] 8_2_0167019F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F2050 mov eax, dword ptr fs:[00000030h] 8_2_015F2050
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161C073 mov eax, dword ptr fs:[00000030h] 8_2_0161C073
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01676050 mov eax, dword ptr fs:[00000030h] 8_2_01676050
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01686030 mov eax, dword ptr fs:[00000030h] 8_2_01686030
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01674000 mov ecx, dword ptr fs:[00000030h] 8_2_01674000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 mov eax, dword ptr fs:[00000030h] 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 mov eax, dword ptr fs:[00000030h] 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 mov eax, dword ptr fs:[00000030h] 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 mov eax, dword ptr fs:[00000030h] 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 mov eax, dword ptr fs:[00000030h] 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 mov eax, dword ptr fs:[00000030h] 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 mov eax, dword ptr fs:[00000030h] 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01692000 mov eax, dword ptr fs:[00000030h] 8_2_01692000
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E016 mov eax, dword ptr fs:[00000030h] 8_2_0160E016
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E016 mov eax, dword ptr fs:[00000030h] 8_2_0160E016
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E016 mov eax, dword ptr fs:[00000030h] 8_2_0160E016
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E016 mov eax, dword ptr fs:[00000030h] 8_2_0160E016
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EA020 mov eax, dword ptr fs:[00000030h] 8_2_015EA020
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EC020 mov eax, dword ptr fs:[00000030h] 8_2_015EC020
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016760E0 mov eax, dword ptr fs:[00000030h] 8_2_016760E0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016320F0 mov ecx, dword ptr fs:[00000030h] 8_2_016320F0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EC0F0 mov eax, dword ptr fs:[00000030h] 8_2_015EC0F0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F80E9 mov eax, dword ptr fs:[00000030h] 8_2_015F80E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016720DE mov eax, dword ptr fs:[00000030h] 8_2_016720DE
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EA0E3 mov ecx, dword ptr fs:[00000030h] 8_2_015EA0E3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016880A8 mov eax, dword ptr fs:[00000030h] 8_2_016880A8
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B60B8 mov eax, dword ptr fs:[00000030h] 8_2_016B60B8
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B60B8 mov ecx, dword ptr fs:[00000030h] 8_2_016B60B8
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F208A mov eax, dword ptr fs:[00000030h] 8_2_015F208A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169437C mov eax, dword ptr fs:[00000030h] 8_2_0169437C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01672349 mov eax, dword ptr fs:[00000030h] 8_2_01672349
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BA352 mov eax, dword ptr fs:[00000030h] 8_2_016BA352
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01698350 mov ecx, dword ptr fs:[00000030h] 8_2_01698350
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167035C mov eax, dword ptr fs:[00000030h] 8_2_0167035C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167035C mov eax, dword ptr fs:[00000030h] 8_2_0167035C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167035C mov eax, dword ptr fs:[00000030h] 8_2_0167035C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167035C mov ecx, dword ptr fs:[00000030h] 8_2_0167035C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167035C mov eax, dword ptr fs:[00000030h] 8_2_0167035C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167035C mov eax, dword ptr fs:[00000030h] 8_2_0167035C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EC310 mov ecx, dword ptr fs:[00000030h] 8_2_015EC310
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A30B mov eax, dword ptr fs:[00000030h] 8_2_0162A30B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A30B mov eax, dword ptr fs:[00000030h] 8_2_0162A30B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A30B mov eax, dword ptr fs:[00000030h] 8_2_0162A30B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01610310 mov ecx, dword ptr fs:[00000030h] 8_2_01610310
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016003E9 mov eax, dword ptr fs:[00000030h] 8_2_016003E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016003E9 mov eax, dword ptr fs:[00000030h] 8_2_016003E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016003E9 mov eax, dword ptr fs:[00000030h] 8_2_016003E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016003E9 mov eax, dword ptr fs:[00000030h] 8_2_016003E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016003E9 mov eax, dword ptr fs:[00000030h] 8_2_016003E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016003E9 mov eax, dword ptr fs:[00000030h] 8_2_016003E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016003E9 mov eax, dword ptr fs:[00000030h] 8_2_016003E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016003E9 mov eax, dword ptr fs:[00000030h] 8_2_016003E9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E3F0 mov eax, dword ptr fs:[00000030h] 8_2_0160E3F0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E3F0 mov eax, dword ptr fs:[00000030h] 8_2_0160E3F0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E3F0 mov eax, dword ptr fs:[00000030h] 8_2_0160E3F0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016263FF mov eax, dword ptr fs:[00000030h] 8_2_016263FF
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F83C0 mov eax, dword ptr fs:[00000030h] 8_2_015F83C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F83C0 mov eax, dword ptr fs:[00000030h] 8_2_015F83C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F83C0 mov eax, dword ptr fs:[00000030h] 8_2_015F83C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F83C0 mov eax, dword ptr fs:[00000030h] 8_2_015F83C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 8_2_015FA3C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 8_2_015FA3C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 8_2_015FA3C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 8_2_015FA3C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 8_2_015FA3C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA3C0 mov eax, dword ptr fs:[00000030h] 8_2_015FA3C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AC3CD mov eax, dword ptr fs:[00000030h] 8_2_016AC3CD
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016763C0 mov eax, dword ptr fs:[00000030h] 8_2_016763C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E3DB mov eax, dword ptr fs:[00000030h] 8_2_0169E3DB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E3DB mov eax, dword ptr fs:[00000030h] 8_2_0169E3DB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E3DB mov ecx, dword ptr fs:[00000030h] 8_2_0169E3DB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169E3DB mov eax, dword ptr fs:[00000030h] 8_2_0169E3DB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016943D4 mov eax, dword ptr fs:[00000030h] 8_2_016943D4
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016943D4 mov eax, dword ptr fs:[00000030h] 8_2_016943D4
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E8397 mov eax, dword ptr fs:[00000030h] 8_2_015E8397
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E8397 mov eax, dword ptr fs:[00000030h] 8_2_015E8397
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E8397 mov eax, dword ptr fs:[00000030h] 8_2_015E8397
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EE388 mov eax, dword ptr fs:[00000030h] 8_2_015EE388
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EE388 mov eax, dword ptr fs:[00000030h] 8_2_015EE388
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EE388 mov eax, dword ptr fs:[00000030h] 8_2_015EE388
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161438F mov eax, dword ptr fs:[00000030h] 8_2_0161438F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161438F mov eax, dword ptr fs:[00000030h] 8_2_0161438F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6259 mov eax, dword ptr fs:[00000030h] 8_2_015F6259
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EA250 mov eax, dword ptr fs:[00000030h] 8_2_015EA250
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A0274 mov eax, dword ptr fs:[00000030h] 8_2_016A0274
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01678243 mov eax, dword ptr fs:[00000030h] 8_2_01678243
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01678243 mov ecx, dword ptr fs:[00000030h] 8_2_01678243
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E826B mov eax, dword ptr fs:[00000030h] 8_2_015E826B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AA250 mov eax, dword ptr fs:[00000030h] 8_2_016AA250
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AA250 mov eax, dword ptr fs:[00000030h] 8_2_016AA250
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F4260 mov eax, dword ptr fs:[00000030h] 8_2_015F4260
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F4260 mov eax, dword ptr fs:[00000030h] 8_2_015F4260
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F4260 mov eax, dword ptr fs:[00000030h] 8_2_015F4260
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E823B mov eax, dword ptr fs:[00000030h] 8_2_015E823B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016002E1 mov eax, dword ptr fs:[00000030h] 8_2_016002E1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016002E1 mov eax, dword ptr fs:[00000030h] 8_2_016002E1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016002E1 mov eax, dword ptr fs:[00000030h] 8_2_016002E1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 8_2_015FA2C3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 8_2_015FA2C3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 8_2_015FA2C3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 8_2_015FA2C3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA2C3 mov eax, dword ptr fs:[00000030h] 8_2_015FA2C3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016002A0 mov eax, dword ptr fs:[00000030h] 8_2_016002A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016002A0 mov eax, dword ptr fs:[00000030h] 8_2_016002A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016862A0 mov eax, dword ptr fs:[00000030h] 8_2_016862A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016862A0 mov ecx, dword ptr fs:[00000030h] 8_2_016862A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016862A0 mov eax, dword ptr fs:[00000030h] 8_2_016862A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016862A0 mov eax, dword ptr fs:[00000030h] 8_2_016862A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016862A0 mov eax, dword ptr fs:[00000030h] 8_2_016862A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016862A0 mov eax, dword ptr fs:[00000030h] 8_2_016862A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01670283 mov eax, dword ptr fs:[00000030h] 8_2_01670283
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01670283 mov eax, dword ptr fs:[00000030h] 8_2_01670283
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01670283 mov eax, dword ptr fs:[00000030h] 8_2_01670283
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E284 mov eax, dword ptr fs:[00000030h] 8_2_0162E284
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E284 mov eax, dword ptr fs:[00000030h] 8_2_0162E284
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162656A mov eax, dword ptr fs:[00000030h] 8_2_0162656A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162656A mov eax, dword ptr fs:[00000030h] 8_2_0162656A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162656A mov eax, dword ptr fs:[00000030h] 8_2_0162656A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8550 mov eax, dword ptr fs:[00000030h] 8_2_015F8550
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8550 mov eax, dword ptr fs:[00000030h] 8_2_015F8550
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600535 mov eax, dword ptr fs:[00000030h] 8_2_01600535
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600535 mov eax, dword ptr fs:[00000030h] 8_2_01600535
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600535 mov eax, dword ptr fs:[00000030h] 8_2_01600535
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600535 mov eax, dword ptr fs:[00000030h] 8_2_01600535
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600535 mov eax, dword ptr fs:[00000030h] 8_2_01600535
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600535 mov eax, dword ptr fs:[00000030h] 8_2_01600535
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E53E mov eax, dword ptr fs:[00000030h] 8_2_0161E53E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E53E mov eax, dword ptr fs:[00000030h] 8_2_0161E53E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E53E mov eax, dword ptr fs:[00000030h] 8_2_0161E53E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E53E mov eax, dword ptr fs:[00000030h] 8_2_0161E53E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E53E mov eax, dword ptr fs:[00000030h] 8_2_0161E53E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01686500 mov eax, dword ptr fs:[00000030h] 8_2_01686500
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C4500 mov eax, dword ptr fs:[00000030h] 8_2_016C4500
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C4500 mov eax, dword ptr fs:[00000030h] 8_2_016C4500
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C4500 mov eax, dword ptr fs:[00000030h] 8_2_016C4500
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C4500 mov eax, dword ptr fs:[00000030h] 8_2_016C4500
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C4500 mov eax, dword ptr fs:[00000030h] 8_2_016C4500
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C4500 mov eax, dword ptr fs:[00000030h] 8_2_016C4500
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C4500 mov eax, dword ptr fs:[00000030h] 8_2_016C4500
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0161E5E7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0161E5E7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0161E5E7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0161E5E7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0161E5E7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0161E5E7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0161E5E7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E5E7 mov eax, dword ptr fs:[00000030h] 8_2_0161E5E7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F65D0 mov eax, dword ptr fs:[00000030h] 8_2_015F65D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162C5ED mov eax, dword ptr fs:[00000030h] 8_2_0162C5ED
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162C5ED mov eax, dword ptr fs:[00000030h] 8_2_0162C5ED
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E5CF mov eax, dword ptr fs:[00000030h] 8_2_0162E5CF
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E5CF mov eax, dword ptr fs:[00000030h] 8_2_0162E5CF
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A5D0 mov eax, dword ptr fs:[00000030h] 8_2_0162A5D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A5D0 mov eax, dword ptr fs:[00000030h] 8_2_0162A5D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F25E0 mov eax, dword ptr fs:[00000030h] 8_2_015F25E0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016705A7 mov eax, dword ptr fs:[00000030h] 8_2_016705A7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016705A7 mov eax, dword ptr fs:[00000030h] 8_2_016705A7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016705A7 mov eax, dword ptr fs:[00000030h] 8_2_016705A7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016145B1 mov eax, dword ptr fs:[00000030h] 8_2_016145B1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016145B1 mov eax, dword ptr fs:[00000030h] 8_2_016145B1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F2582 mov eax, dword ptr fs:[00000030h] 8_2_015F2582
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F2582 mov ecx, dword ptr fs:[00000030h] 8_2_015F2582
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01624588 mov eax, dword ptr fs:[00000030h] 8_2_01624588
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E59C mov eax, dword ptr fs:[00000030h] 8_2_0162E59C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E645D mov eax, dword ptr fs:[00000030h] 8_2_015E645D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167C460 mov ecx, dword ptr fs:[00000030h] 8_2_0167C460
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161A470 mov eax, dword ptr fs:[00000030h] 8_2_0161A470
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161A470 mov eax, dword ptr fs:[00000030h] 8_2_0161A470
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161A470 mov eax, dword ptr fs:[00000030h] 8_2_0161A470
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E443 mov eax, dword ptr fs:[00000030h] 8_2_0162E443
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E443 mov eax, dword ptr fs:[00000030h] 8_2_0162E443
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E443 mov eax, dword ptr fs:[00000030h] 8_2_0162E443
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E443 mov eax, dword ptr fs:[00000030h] 8_2_0162E443
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E443 mov eax, dword ptr fs:[00000030h] 8_2_0162E443
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E443 mov eax, dword ptr fs:[00000030h] 8_2_0162E443
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E443 mov eax, dword ptr fs:[00000030h] 8_2_0162E443
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162E443 mov eax, dword ptr fs:[00000030h] 8_2_0162E443
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161245A mov eax, dword ptr fs:[00000030h] 8_2_0161245A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AA456 mov eax, dword ptr fs:[00000030h] 8_2_016AA456
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01676420 mov eax, dword ptr fs:[00000030h] 8_2_01676420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01676420 mov eax, dword ptr fs:[00000030h] 8_2_01676420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01676420 mov eax, dword ptr fs:[00000030h] 8_2_01676420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01676420 mov eax, dword ptr fs:[00000030h] 8_2_01676420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01676420 mov eax, dword ptr fs:[00000030h] 8_2_01676420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01676420 mov eax, dword ptr fs:[00000030h] 8_2_01676420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01676420 mov eax, dword ptr fs:[00000030h] 8_2_01676420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01628402 mov eax, dword ptr fs:[00000030h] 8_2_01628402
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01628402 mov eax, dword ptr fs:[00000030h] 8_2_01628402
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01628402 mov eax, dword ptr fs:[00000030h] 8_2_01628402
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EC427 mov eax, dword ptr fs:[00000030h] 8_2_015EC427
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EE420 mov eax, dword ptr fs:[00000030h] 8_2_015EE420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EE420 mov eax, dword ptr fs:[00000030h] 8_2_015EE420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015EE420 mov eax, dword ptr fs:[00000030h] 8_2_015EE420
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F04E5 mov ecx, dword ptr fs:[00000030h] 8_2_015F04E5
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016244B0 mov ecx, dword ptr fs:[00000030h] 8_2_016244B0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167A4B0 mov eax, dword ptr fs:[00000030h] 8_2_0167A4B0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016AA49A mov eax, dword ptr fs:[00000030h] 8_2_016AA49A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F64AB mov eax, dword ptr fs:[00000030h] 8_2_015F64AB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0750 mov eax, dword ptr fs:[00000030h] 8_2_015F0750
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600770 mov eax, dword ptr fs:[00000030h] 8_2_01600770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8770 mov eax, dword ptr fs:[00000030h] 8_2_015F8770
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162674D mov esi, dword ptr fs:[00000030h] 8_2_0162674D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162674D mov eax, dword ptr fs:[00000030h] 8_2_0162674D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162674D mov eax, dword ptr fs:[00000030h] 8_2_0162674D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01674755 mov eax, dword ptr fs:[00000030h] 8_2_01674755
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632750 mov eax, dword ptr fs:[00000030h] 8_2_01632750
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632750 mov eax, dword ptr fs:[00000030h] 8_2_01632750
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167E75D mov eax, dword ptr fs:[00000030h] 8_2_0167E75D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162C720 mov eax, dword ptr fs:[00000030h] 8_2_0162C720
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162C720 mov eax, dword ptr fs:[00000030h] 8_2_0162C720
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0710 mov eax, dword ptr fs:[00000030h] 8_2_015F0710
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166C730 mov eax, dword ptr fs:[00000030h] 8_2_0166C730
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162273C mov eax, dword ptr fs:[00000030h] 8_2_0162273C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162273C mov ecx, dword ptr fs:[00000030h] 8_2_0162273C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162273C mov eax, dword ptr fs:[00000030h] 8_2_0162273C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162C700 mov eax, dword ptr fs:[00000030h] 8_2_0162C700
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01620710 mov eax, dword ptr fs:[00000030h] 8_2_01620710
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167E7E1 mov eax, dword ptr fs:[00000030h] 8_2_0167E7E1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016127ED mov eax, dword ptr fs:[00000030h] 8_2_016127ED
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016127ED mov eax, dword ptr fs:[00000030h] 8_2_016127ED
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016127ED mov eax, dword ptr fs:[00000030h] 8_2_016127ED
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FC7C0 mov eax, dword ptr fs:[00000030h] 8_2_015FC7C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F47FB mov eax, dword ptr fs:[00000030h] 8_2_015F47FB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F47FB mov eax, dword ptr fs:[00000030h] 8_2_015F47FB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016707C3 mov eax, dword ptr fs:[00000030h] 8_2_016707C3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A47A0 mov eax, dword ptr fs:[00000030h] 8_2_016A47A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169678E mov eax, dword ptr fs:[00000030h] 8_2_0169678E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F07AF mov eax, dword ptr fs:[00000030h] 8_2_015F07AF
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A660 mov eax, dword ptr fs:[00000030h] 8_2_0162A660
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A660 mov eax, dword ptr fs:[00000030h] 8_2_0162A660
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B866E mov eax, dword ptr fs:[00000030h] 8_2_016B866E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B866E mov eax, dword ptr fs:[00000030h] 8_2_016B866E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01622674 mov eax, dword ptr fs:[00000030h] 8_2_01622674
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160C640 mov eax, dword ptr fs:[00000030h] 8_2_0160C640
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01626620 mov eax, dword ptr fs:[00000030h] 8_2_01626620
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01628620 mov eax, dword ptr fs:[00000030h] 8_2_01628620
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160E627 mov eax, dword ptr fs:[00000030h] 8_2_0160E627
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160260B mov eax, dword ptr fs:[00000030h] 8_2_0160260B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160260B mov eax, dword ptr fs:[00000030h] 8_2_0160260B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160260B mov eax, dword ptr fs:[00000030h] 8_2_0160260B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160260B mov eax, dword ptr fs:[00000030h] 8_2_0160260B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160260B mov eax, dword ptr fs:[00000030h] 8_2_0160260B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160260B mov eax, dword ptr fs:[00000030h] 8_2_0160260B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0160260B mov eax, dword ptr fs:[00000030h] 8_2_0160260B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E609 mov eax, dword ptr fs:[00000030h] 8_2_0166E609
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F262C mov eax, dword ptr fs:[00000030h] 8_2_015F262C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01632619 mov eax, dword ptr fs:[00000030h] 8_2_01632619
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E6F2 mov eax, dword ptr fs:[00000030h] 8_2_0166E6F2
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E6F2 mov eax, dword ptr fs:[00000030h] 8_2_0166E6F2
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E6F2 mov eax, dword ptr fs:[00000030h] 8_2_0166E6F2
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E6F2 mov eax, dword ptr fs:[00000030h] 8_2_0166E6F2
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016706F1 mov eax, dword ptr fs:[00000030h] 8_2_016706F1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016706F1 mov eax, dword ptr fs:[00000030h] 8_2_016706F1
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A6C7 mov ebx, dword ptr fs:[00000030h] 8_2_0162A6C7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A6C7 mov eax, dword ptr fs:[00000030h] 8_2_0162A6C7
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162C6A6 mov eax, dword ptr fs:[00000030h] 8_2_0162C6A6
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F4690 mov eax, dword ptr fs:[00000030h] 8_2_015F4690
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F4690 mov eax, dword ptr fs:[00000030h] 8_2_015F4690
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016266B0 mov eax, dword ptr fs:[00000030h] 8_2_016266B0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01616962 mov eax, dword ptr fs:[00000030h] 8_2_01616962
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01616962 mov eax, dword ptr fs:[00000030h] 8_2_01616962
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01616962 mov eax, dword ptr fs:[00000030h] 8_2_01616962
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0163096E mov eax, dword ptr fs:[00000030h] 8_2_0163096E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0163096E mov edx, dword ptr fs:[00000030h] 8_2_0163096E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0163096E mov eax, dword ptr fs:[00000030h] 8_2_0163096E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01694978 mov eax, dword ptr fs:[00000030h] 8_2_01694978
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01694978 mov eax, dword ptr fs:[00000030h] 8_2_01694978
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167C97C mov eax, dword ptr fs:[00000030h] 8_2_0167C97C
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01670946 mov eax, dword ptr fs:[00000030h] 8_2_01670946
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0168892B mov eax, dword ptr fs:[00000030h] 8_2_0168892B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E8918 mov eax, dword ptr fs:[00000030h] 8_2_015E8918
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015E8918 mov eax, dword ptr fs:[00000030h] 8_2_015E8918
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167892A mov eax, dword ptr fs:[00000030h] 8_2_0167892A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E908 mov eax, dword ptr fs:[00000030h] 8_2_0166E908
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166E908 mov eax, dword ptr fs:[00000030h] 8_2_0166E908
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167C912 mov eax, dword ptr fs:[00000030h] 8_2_0167C912
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167E9E0 mov eax, dword ptr fs:[00000030h] 8_2_0167E9E0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 8_2_015FA9D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 8_2_015FA9D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 8_2_015FA9D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 8_2_015FA9D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 8_2_015FA9D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FA9D0 mov eax, dword ptr fs:[00000030h] 8_2_015FA9D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016229F9 mov eax, dword ptr fs:[00000030h] 8_2_016229F9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016229F9 mov eax, dword ptr fs:[00000030h] 8_2_016229F9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016869C0 mov eax, dword ptr fs:[00000030h] 8_2_016869C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016249D0 mov eax, dword ptr fs:[00000030h] 8_2_016249D0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BA9D3 mov eax, dword ptr fs:[00000030h] 8_2_016BA9D3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016029A0 mov eax, dword ptr fs:[00000030h] 8_2_016029A0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016789B3 mov esi, dword ptr fs:[00000030h] 8_2_016789B3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016789B3 mov eax, dword ptr fs:[00000030h] 8_2_016789B3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016789B3 mov eax, dword ptr fs:[00000030h] 8_2_016789B3
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F09AD mov eax, dword ptr fs:[00000030h] 8_2_015F09AD
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F09AD mov eax, dword ptr fs:[00000030h] 8_2_015F09AD
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F4859 mov eax, dword ptr fs:[00000030h] 8_2_015F4859
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F4859 mov eax, dword ptr fs:[00000030h] 8_2_015F4859
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167E872 mov eax, dword ptr fs:[00000030h] 8_2_0167E872
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167E872 mov eax, dword ptr fs:[00000030h] 8_2_0167E872
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01686870 mov eax, dword ptr fs:[00000030h] 8_2_01686870
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01686870 mov eax, dword ptr fs:[00000030h] 8_2_01686870
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01602840 mov ecx, dword ptr fs:[00000030h] 8_2_01602840
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01620854 mov eax, dword ptr fs:[00000030h] 8_2_01620854
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162A830 mov eax, dword ptr fs:[00000030h] 8_2_0162A830
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169483A mov eax, dword ptr fs:[00000030h] 8_2_0169483A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169483A mov eax, dword ptr fs:[00000030h] 8_2_0169483A
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01612835 mov eax, dword ptr fs:[00000030h] 8_2_01612835
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01612835 mov eax, dword ptr fs:[00000030h] 8_2_01612835
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01612835 mov eax, dword ptr fs:[00000030h] 8_2_01612835
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01612835 mov ecx, dword ptr fs:[00000030h] 8_2_01612835
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01612835 mov eax, dword ptr fs:[00000030h] 8_2_01612835
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01612835 mov eax, dword ptr fs:[00000030h] 8_2_01612835
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167C810 mov eax, dword ptr fs:[00000030h] 8_2_0167C810
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BA8E4 mov eax, dword ptr fs:[00000030h] 8_2_016BA8E4
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162C8F9 mov eax, dword ptr fs:[00000030h] 8_2_0162C8F9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162C8F9 mov eax, dword ptr fs:[00000030h] 8_2_0162C8F9
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161E8C0 mov eax, dword ptr fs:[00000030h] 8_2_0161E8C0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0887 mov eax, dword ptr fs:[00000030h] 8_2_015F0887
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167C89D mov eax, dword ptr fs:[00000030h] 8_2_0167C89D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015ECB7E mov eax, dword ptr fs:[00000030h] 8_2_015ECB7E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A4B4B mov eax, dword ptr fs:[00000030h] 8_2_016A4B4B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A4B4B mov eax, dword ptr fs:[00000030h] 8_2_016A4B4B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01686B40 mov eax, dword ptr fs:[00000030h] 8_2_01686B40
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01686B40 mov eax, dword ptr fs:[00000030h] 8_2_01686B40
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016BAB40 mov eax, dword ptr fs:[00000030h] 8_2_016BAB40
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01698B42 mov eax, dword ptr fs:[00000030h] 8_2_01698B42
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169EB50 mov eax, dword ptr fs:[00000030h] 8_2_0169EB50
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161EB20 mov eax, dword ptr fs:[00000030h] 8_2_0161EB20
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161EB20 mov eax, dword ptr fs:[00000030h] 8_2_0161EB20
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B8B28 mov eax, dword ptr fs:[00000030h] 8_2_016B8B28
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016B8B28 mov eax, dword ptr fs:[00000030h] 8_2_016B8B28
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166EB1D mov eax, dword ptr fs:[00000030h] 8_2_0166EB1D
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0BCD mov eax, dword ptr fs:[00000030h] 8_2_015F0BCD
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0BCD mov eax, dword ptr fs:[00000030h] 8_2_015F0BCD
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0BCD mov eax, dword ptr fs:[00000030h] 8_2_015F0BCD
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167CBF0 mov eax, dword ptr fs:[00000030h] 8_2_0167CBF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161EBFC mov eax, dword ptr fs:[00000030h] 8_2_0161EBFC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01610BCB mov eax, dword ptr fs:[00000030h] 8_2_01610BCB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01610BCB mov eax, dword ptr fs:[00000030h] 8_2_01610BCB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01610BCB mov eax, dword ptr fs:[00000030h] 8_2_01610BCB
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8BF0 mov eax, dword ptr fs:[00000030h] 8_2_015F8BF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8BF0 mov eax, dword ptr fs:[00000030h] 8_2_015F8BF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8BF0 mov eax, dword ptr fs:[00000030h] 8_2_015F8BF0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169EBD0 mov eax, dword ptr fs:[00000030h] 8_2_0169EBD0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A4BB0 mov eax, dword ptr fs:[00000030h] 8_2_016A4BB0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016A4BB0 mov eax, dword ptr fs:[00000030h] 8_2_016A4BB0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600BBE mov eax, dword ptr fs:[00000030h] 8_2_01600BBE
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600BBE mov eax, dword ptr fs:[00000030h] 8_2_01600BBE
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0169EA60 mov eax, dword ptr fs:[00000030h] 8_2_0169EA60
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162CA6F mov eax, dword ptr fs:[00000030h] 8_2_0162CA6F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162CA6F mov eax, dword ptr fs:[00000030h] 8_2_0162CA6F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162CA6F mov eax, dword ptr fs:[00000030h] 8_2_0162CA6F
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6A50 mov eax, dword ptr fs:[00000030h] 8_2_015F6A50
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6A50 mov eax, dword ptr fs:[00000030h] 8_2_015F6A50
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6A50 mov eax, dword ptr fs:[00000030h] 8_2_015F6A50
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6A50 mov eax, dword ptr fs:[00000030h] 8_2_015F6A50
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6A50 mov eax, dword ptr fs:[00000030h] 8_2_015F6A50
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6A50 mov eax, dword ptr fs:[00000030h] 8_2_015F6A50
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F6A50 mov eax, dword ptr fs:[00000030h] 8_2_015F6A50
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166CA72 mov eax, dword ptr fs:[00000030h] 8_2_0166CA72
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0166CA72 mov eax, dword ptr fs:[00000030h] 8_2_0166CA72
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600A5B mov eax, dword ptr fs:[00000030h] 8_2_01600A5B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01600A5B mov eax, dword ptr fs:[00000030h] 8_2_01600A5B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162CA24 mov eax, dword ptr fs:[00000030h] 8_2_0162CA24
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0161EA2E mov eax, dword ptr fs:[00000030h] 8_2_0161EA2E
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01614A35 mov eax, dword ptr fs:[00000030h] 8_2_01614A35
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01614A35 mov eax, dword ptr fs:[00000030h] 8_2_01614A35
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0167CA11 mov eax, dword ptr fs:[00000030h] 8_2_0167CA11
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162AAEE mov eax, dword ptr fs:[00000030h] 8_2_0162AAEE
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_0162AAEE mov eax, dword ptr fs:[00000030h] 8_2_0162AAEE
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0AD0 mov eax, dword ptr fs:[00000030h] 8_2_015F0AD0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01646ACC mov eax, dword ptr fs:[00000030h] 8_2_01646ACC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01646ACC mov eax, dword ptr fs:[00000030h] 8_2_01646ACC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01646ACC mov eax, dword ptr fs:[00000030h] 8_2_01646ACC
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01624AD0 mov eax, dword ptr fs:[00000030h] 8_2_01624AD0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01624AD0 mov eax, dword ptr fs:[00000030h] 8_2_01624AD0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01646AA4 mov eax, dword ptr fs:[00000030h] 8_2_01646AA4
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015FEA80 mov eax, dword ptr fs:[00000030h] 8_2_015FEA80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_016C4A80 mov eax, dword ptr fs:[00000030h] 8_2_016C4A80
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01628A90 mov edx, dword ptr fs:[00000030h] 8_2_01628A90
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8AA0 mov eax, dword ptr fs:[00000030h] 8_2_015F8AA0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8AA0 mov eax, dword ptr fs:[00000030h] 8_2_015F8AA0
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_01688D6B mov eax, dword ptr fs:[00000030h] 8_2_01688D6B
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0D59 mov eax, dword ptr fs:[00000030h] 8_2_015F0D59
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0D59 mov eax, dword ptr fs:[00000030h] 8_2_015F0D59
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F0D59 mov eax, dword ptr fs:[00000030h] 8_2_015F0D59
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8D59 mov eax, dword ptr fs:[00000030h] 8_2_015F8D59
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8D59 mov eax, dword ptr fs:[00000030h] 8_2_015F8D59
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8D59 mov eax, dword ptr fs:[00000030h] 8_2_015F8D59
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8D59 mov eax, dword ptr fs:[00000030h] 8_2_015F8D59
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Code function: 8_2_015F8D59 mov eax, dword ptr fs:[00000030h] 8_2_015F8D59
Enables debug privileges
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FGGx944Qu7.exe"
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe"
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FGGx944Qu7.exe" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe" Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtWriteVirtualMemory: Direct from: 0x76F0490C Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtAllocateVirtualMemory: Direct from: 0x76F03C9C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtClose: Direct from: 0x76F02B6C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtReadVirtualMemory: Direct from: 0x76F02E8C Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtCreateKey: Direct from: 0x76F02C6C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtSetInformationThread: Direct from: 0x76F02B4C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtQueryAttributesFile: Direct from: 0x76F02E6C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtAllocateVirtualMemory: Direct from: 0x76F048EC Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtQuerySystemInformation: Direct from: 0x76F048CC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtQueryVolumeInformationFile: Direct from: 0x76F02F2C Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtOpenSection: Direct from: 0x76F02E0C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtSetInformationThread: Direct from: 0x76EF63F9
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtDeviceIoControlFile: Direct from: 0x76F02AEC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtAllocateVirtualMemory: Direct from: 0x76F02BEC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtCreateFile: Direct from: 0x76F02FEC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtOpenFile: Direct from: 0x76F02DCC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtQueryInformationToken: Direct from: 0x76F02CAC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtProtectVirtualMemory: Direct from: 0x76EF7B2E
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtTerminateThread: Direct from: 0x76F02FCC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtOpenKeyEx: Direct from: 0x76F02B9C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtProtectVirtualMemory: Direct from: 0x76F02F9C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtSetInformationProcess: Direct from: 0x76F02C5C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtNotifyChangeKey: Direct from: 0x76F03C2C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtUnmapViewOfSection: Direct from: 0x76F02D3C Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtCreateMutant: Direct from: 0x76F035CC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtWriteVirtualMemory: Direct from: 0x76F02E3C Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtMapViewOfSection: Direct from: 0x76F02D1C
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtResumeThread: Direct from: 0x76F036AC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtAllocateVirtualMemory: Direct from: 0x76F02BFC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtReadFile: Direct from: 0x76F02ADC Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtQuerySystemInformation: Direct from: 0x76F02DFC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtDelayExecution: Direct from: 0x76F02DDC
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtQueryInformationProcess: Direct from: 0x76F02C26
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtResumeThread: Direct from: 0x76F02FBC Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe NtCreateUserProcess: Direct from: 0x76F0371C Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Memory written: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: NULL target: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Section loaded: NULL target: C:\Windows\SysWOW64\SearchProtocolHost.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: NULL target: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: NULL target: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Section loaded: NULL target: C:\Program Files\Mozilla Firefox\firefox.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Thread register set: target process: 7468
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Thread APC queued: target process: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\FGGx944Qu7.exe" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TBsjWljiCpR" /XML "C:\Users\user\AppData\Local\Temp\tmp1454.tmp" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Users\user\Desktop\FGGx944Qu7.exe "C:\Users\user\Desktop\FGGx944Qu7.exe" Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Process created: C:\Users\user\Desktop\FGGx944Qu7.exe "C:\Users\user\Desktop\FGGx944Qu7.exe" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process created: C:\Windows\SysWOW64\schtasks.exe "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TBsjWljiCpR" /XML "C:\Users\user\AppData\Local\Temp\tmp350B.tmp" Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Process created: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe "C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe" Jump to behavior
Source: C:\Program Files (x86)\ATqfrwJeiSEkHpSwLmQcLcKjItaMjYnOwempnyfloVJBHkJly\usFxdnRPYjnb.exe Process created: C:\Windows\SysWOW64\SearchProtocolHost.exe "C:\Windows\SysWOW64\SearchProtocolHost.exe" Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Process created: C:\Program Files\Mozilla Firefox\firefox.exe "C:\Program Files\Mozilla Firefox\Firefox.exe"
Source: usFxdnRPYjnb.exe, 0000000F.00000000.1869517968.0000000001360000.00000002.00000001.00040000.00000000.sdmp, usFxdnRPYjnb.exe, 0000000F.00000002.2862677083.0000000001360000.00000002.00000001.00040000.00000000.sdmp, usFxdnRPYjnb.exe, 00000013.00000000.2032350481.00000000019E1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: usFxdnRPYjnb.exe, 0000000F.00000000.1869517968.0000000001360000.00000002.00000001.00040000.00000000.sdmp, usFxdnRPYjnb.exe, 0000000F.00000002.2862677083.0000000001360000.00000002.00000001.00040000.00000000.sdmp, usFxdnRPYjnb.exe, 00000013.00000000.2032350481.00000000019E1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: usFxdnRPYjnb.exe, 0000000F.00000000.1869517968.0000000001360000.00000002.00000001.00040000.00000000.sdmp, usFxdnRPYjnb.exe, 0000000F.00000002.2862677083.0000000001360000.00000002.00000001.00040000.00000000.sdmp, usFxdnRPYjnb.exe, 00000013.00000000.2032350481.00000000019E1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: usFxdnRPYjnb.exe, 0000000F.00000000.1869517968.0000000001360000.00000002.00000001.00040000.00000000.sdmp, usFxdnRPYjnb.exe, 0000000F.00000002.2862677083.0000000001360000.00000002.00000001.00040000.00000000.sdmp, usFxdnRPYjnb.exe, 00000013.00000000.2032350481.00000000019E1000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: }Program Manager
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Queries volume information: C:\Users\user\Desktop\FGGx944Qu7.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Queries volume information: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\AppData\Roaming\TBsjWljiCpR.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\FGGx944Qu7.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
Adds / modifies Windows certificates
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Registry key created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\AFE5D244A8D1194230FF479FE2F897BBCD7A8CB4 Blob Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.FGGx944Qu7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.FGGx944Qu7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.2863758312.0000000003070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2861231272.0000000002A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1946159228.0000000001510000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1945331228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2863668034.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2863047851.0000000004760000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1948193173.0000000003810000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Tries to harvest and steal browser information (history, passwords, etc)
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Network\Cookies Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe File opened: C:\Users\user\AppData\Local\Microsoft\Edge\User Data\Default\Login Data Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Network\Local State Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Local State Jump to behavior
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe File opened: C:\Users\user\AppData\Local\Google\Chrome\User Data\Default\Web Data Jump to behavior
Tries to steal Mail credentials (via file / registry access)
Source: C:\Windows\SysWOW64\SearchProtocolHost.exe Key opened: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\ Jump to behavior

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 8.2.FGGx944Qu7.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 8.2.FGGx944Qu7.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000010.00000002.2863758312.0000000003070000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2861231272.0000000002A20000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1946159228.0000000001510000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1945331228.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.2863668034.0000000003030000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000F.00000002.2863047851.0000000004760000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.1948193173.0000000003810000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1443953 Sample: FGGx944Qu7.exe Startdate: 19/05/2024 Architecture: WINDOWS Score: 100 55 www.drapples.club 2->55 57 www.birthingwitht.com 2->57 59 4 other IPs or domains 2->59 71 Malicious sample detected (through community Yara rule) 2->71 73 Antivirus detection for URL or domain 2->73 75 Antivirus / Scanner detection for submitted sample 2->75 77 8 other signatures 2->77 10 FGGx944Qu7.exe 7 2->10         started        14 TBsjWljiCpR.exe 5 2->14         started        signatures3 process4 file5 51 C:\Users\user\AppData\...\TBsjWljiCpR.exe, PE32 10->51 dropped 53 C:\Users\user\AppData\Local\...\tmp1454.tmp, XML 10->53 dropped 87 Uses schtasks.exe or at.exe to add and modify task schedules 10->87 89 Adds a directory exclusion to Windows Defender 10->89 16 FGGx944Qu7.exe 10->16         started        19 powershell.exe 23 10->19         started        21 powershell.exe 23 10->21         started        27 2 other processes 10->27 91 Antivirus detection for dropped file 14->91 93 Multi AV Scanner detection for dropped file 14->93 95 Machine Learning detection for dropped file 14->95 97 Injects a PE file into a foreign processes 14->97 23 schtasks.exe 1 14->23         started        25 TBsjWljiCpR.exe 14->25         started        signatures6 process7 signatures8 67 Maps a DLL or memory area into another process 16->67 29 usFxdnRPYjnb.exe 16->29 injected 69 Loading BitLocker PowerShell Module 19->69 32 WmiPrvSE.exe 19->32         started        34 conhost.exe 19->34         started        36 conhost.exe 21->36         started        38 conhost.exe 23->38         started        40 conhost.exe 27->40         started        process9 signatures10 99 Found direct / indirect Syscall (likely to bypass EDR) 29->99 42 SearchProtocolHost.exe 13 29->42         started        process11 signatures12 79 Tries to steal Mail credentials (via file / registry access) 42->79 81 Tries to harvest and steal browser information (history, passwords, etc) 42->81 83 Modifies the context of a thread in another process (thread injection) 42->83 85 2 other signatures 42->85 45 usFxdnRPYjnb.exe 42->45 injected 49 firefox.exe 42->49         started        process13 dnsIp14 61 www.oobzxod2xn.cc 172.67.140.176, 49754, 80 CLOUDFLARENETUS United States 45->61 63 94950.bodis.com 199.59.243.225, 49758, 49760, 80 BODIS-NJUS United States 45->63 65 td-ccm-neg-87-45.wixdns.net 34.149.87.45, 80 ATGS-MMD-ASUS United States 45->65 101 Found direct / indirect Syscall (likely to bypass EDR) 45->101 signatures15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
172.67.140.176
 www.oobzxod2xn.cc United States
13335 CLOUDFLARENETUS false
34.149.87.45
 td-ccm-neg-87-45.wixdns.net United States
2686 ATGS-MMD-ASUS false
199.59.243.225
 94950.bodis.com United States
395082 BODIS-NJUS false

Contacted Domains

Name IP Active
www.oobzxod2xn.cc 172.67.140.176 true
94950.bodis.com 199.59.243.225 true
td-ccm-neg-87-45.wixdns.net 34.149.87.45 true
www.birthingwitht.com unknown unknown
www.drapples.club unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.oobzxod2xn.cc/q0r6/?uZgP=5pyvScKx6ZbOO2uX774/2f03V4PpvoLdLg/OCd1FMvXsxJY7YeHi6SxOzHnr25kvmJZHa8XXHydHc3e54xwdxF+eQrhYMnjeuarocBe7v18XiUqzaWXVlPw=&a6m=8Rw4HDhPzbgPS false
  • Avira URL Cloud: safe
 unknown
http://www.drapples.club/q0r6/ false
  • 0%, Virustotal, Browse
  • Avira URL Cloud: phishing
 unknown