Windows Analysis Report
SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe

Overview

General Information

Sample name: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe
Analysis ID: 1544699
MD5: 9b8a71b09ca89696e15256d79a7b5d09
SHA1: dfaaf3c9526984ba92ce288e2e39914f4eb059aa
SHA256: cc97cd2834a545c6f4e89aea88a758f9fd880586f55d21dda5c8dd2017ed689b
Tags: exeFormbook
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
AV process strings found (often used to terminate AV products)
Allocates memory with a write watch (potentially for evading sandboxes)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
One or more processes crash
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for submitted file
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe ReversingLabs: Detection: 42%
Yara detected FormBook
Source: Yara match File source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.2323640935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000004.00000002.2324721299.0000000001170000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000004.00000002.2324721299.0000000001170000.00000040.00001000.00020000.00000000.sdmp
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000000.00000002.2155081651.00000000026C4000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: Amcache.hve.10.dr String found in binary or memory: http://upx.sf.net

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.2323640935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.2323640935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A13B8C NtQueryInformationProcess, 0_2_06A13B8C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A18C00 NtQueryInformationProcess, 0_2_06A18C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0042C923 NtClose, 4_2_0042C923
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2DF0 NtQuerySystemInformation,LdrInitializeThunk, 4_2_011E2DF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E4340 NtSetContextThread, 4_2_011E4340
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E4650 NtSuspendThread, 4_2_011E4650
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2B60 NtClose, 4_2_011E2B60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2B80 NtQueryInformationFile, 4_2_011E2B80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2BA0 NtEnumerateValueKey, 4_2_011E2BA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2BF0 NtAllocateVirtualMemory, 4_2_011E2BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2BE0 NtQueryValueKey, 4_2_011E2BE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2AB0 NtWaitForSingleObject, 4_2_011E2AB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2AD0 NtReadFile, 4_2_011E2AD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2AF0 NtWriteFile, 4_2_011E2AF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2D10 NtMapViewOfSection, 4_2_011E2D10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2D00 NtSetInformationFile, 4_2_011E2D00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2D30 NtUnmapViewOfSection, 4_2_011E2D30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2DB0 NtEnumerateKey, 4_2_011E2DB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2DD0 NtDelayExecution, 4_2_011E2DD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2C00 NtQueryInformationProcess, 4_2_011E2C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2C70 NtFreeVirtualMemory, 4_2_011E2C70
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2C60 NtCreateKey, 4_2_011E2C60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2CA0 NtQueryInformationToken, 4_2_011E2CA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2CC0 NtQueryVirtualMemory, 4_2_011E2CC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2CF0 NtOpenProcess, 4_2_011E2CF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2F30 NtCreateSection, 4_2_011E2F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2F60 NtCreateProcessEx, 4_2_011E2F60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2F90 NtProtectVirtualMemory, 4_2_011E2F90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2FB0 NtResumeThread, 4_2_011E2FB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2FA0 NtQuerySection, 4_2_011E2FA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2FE0 NtCreateFile, 4_2_011E2FE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2E30 NtWriteVirtualMemory, 4_2_011E2E30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2E80 NtReadVirtualMemory, 4_2_011E2E80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2EA0 NtAdjustPrivilegesToken, 4_2_011E2EA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2EE0 NtQueueApcThread, 4_2_011E2EE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E3010 NtOpenDirectoryObject, 4_2_011E3010
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E3090 NtSetValueKey, 4_2_011E3090
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E35C0 NtCreateMutant, 4_2_011E35C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E39B0 NtGetContextThread, 4_2_011E39B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E3D10 NtOpenProcessToken, 4_2_011E3D10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E3D70 NtOpenThread, 4_2_011E3D70
Detected potential crypto function
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_0236D3C4 0_2_0236D3C4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_0670E100 0_2_0670E100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_0670E7D8 0_2_0670E7D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_0670E0FC 0_2_0670E0FC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A1E4B0 0_2_06A1E4B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A15EF2 0_2_06A15EF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A14C21 0_2_06A14C21
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A1A788 0_2_06A1A788
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A1A778 0_2_06A1A778
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A1E4A1 0_2_06A1E4A1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A184D8 0_2_06A184D8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A18018 0_2_06A18018
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A18D88 0_2_06A18D88
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A1AA10 0_2_06A1AA10
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A17BE0 0_2_06A17BE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A17BD0 0_2_06A17BD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06A1A9FF 0_2_06A1A9FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06B06920 0_2_06B06920
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06B02BE0 0_2_06B02BE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06B00C98 0_2_06B00C98
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06B014F8 0_2_06B014F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06B010D0 0_2_06B010D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06B01931 0_2_06B01931
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06B01508 0_2_06B01508
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06B01940 0_2_06B01940
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00410103 4_2_00410103
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00402921 4_2_00402921
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00402930 4_2_00402930
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_004011C0 4_2_004011C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_004031A0 4_2_004031A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00416A7E 4_2_00416A7E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00416A83 4_2_00416A83
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00410323 4_2_00410323
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0040E3A3 4_2_0040E3A3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0040E4E7 4_2_0040E4E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00402600 4_2_00402600
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0042EF53 4_2_0042EF53
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A0100 4_2_011A0100
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124A118 4_2_0124A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01238158 4_2_01238158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012641A2 4_2_012641A2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012701AA 4_2_012701AA
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012681CC 4_2_012681CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126A352 4_2_0126A352
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012703E6 4_2_012703E6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE3F0 4_2_011BE3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012302C0 4_2_012302C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0535 4_2_011B0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01270591 4_2_01270591
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01254420 4_2_01254420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01262446 4_2_01262446
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125E4F6 4_2_0125E4F6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D4750 4_2_011D4750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AC7C0 4_2_011AC7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CC6E0 4_2_011CC6E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C6962 4_2_011C6962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0127A9A6 4_2_0127A9A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BA840 4_2_011BA840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B2840 4_2_011B2840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011968B8 4_2_011968B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE8F0 4_2_011DE8F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126AB40 4_2_0126AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01266BD7 4_2_01266BD7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BAD00 4_2_011BAD00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124CD1F 4_2_0124CD1F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C8DBF 4_2_011C8DBF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AADE0 4_2_011AADE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0C00 4_2_011B0C00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250CB5 4_2_01250CB5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A0CF2 4_2_011A0CF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01252F30 4_2_01252F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D0F30 4_2_011D0F30
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011F2F28 4_2_011F2F28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01224F40 4_2_01224F40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122EFA0 4_2_0122EFA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A2FC8 4_2_011A2FC8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BCFE0 4_2_011BCFE0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126EE26 4_2_0126EE26
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0E59 4_2_011B0E59
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C2E90 4_2_011C2E90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126CE93 4_2_0126CE93
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126EEDB 4_2_0126EEDB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0127B16B 4_2_0127B16B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119F172 4_2_0119F172
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E516C 4_2_011E516C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BB1B0 4_2_011BB1B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126F0E0 4_2_0126F0E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012670E9 4_2_012670E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B70C0 4_2_011B70C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125F0CC 4_2_0125F0CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126132D 4_2_0126132D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119D34C 4_2_0119D34C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011F739A 4_2_011F739A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B52A0 4_2_011B52A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012512ED 4_2_012512ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CB2C0 4_2_011CB2C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01267571 4_2_01267571
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124D5B0 4_2_0124D5B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012795C3 4_2_012795C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126F43F 4_2_0126F43F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A1460 4_2_011A1460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126F7B0 4_2_0126F7B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011F5630 4_2_011F5630
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012616CC 4_2_012616CC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01245910 4_2_01245910
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B9950 4_2_011B9950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CB950 4_2_011CB950
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121D800 4_2_0121D800
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B38E0 4_2_011B38E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126FB76 4_2_0126FB76
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CFB80 4_2_011CFB80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01225BF0 4_2_01225BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011EDBF9 4_2_011EDBF9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01223A6C 4_2_01223A6C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01267A46 4_2_01267A46
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126FA49 4_2_0126FA49
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01251AA3 4_2_01251AA3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124DAAC 4_2_0124DAAC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011F5AA0 4_2_011F5AA0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125DAC6 4_2_0125DAC6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01267D73 4_2_01267D73
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B3D40 4_2_011B3D40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01261D5A 4_2_01261D5A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CFDC0 4_2_011CFDC0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01229C32 4_2_01229C32
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126FCF2 4_2_0126FCF2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126FF09 4_2_0126FF09
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B1F92 4_2_011B1F92
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126FFB1 4_2_0126FFB1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01173FD5 4_2_01173FD5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01173FD2 4_2_01173FD2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B9EB0 4_2_011B9EB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: String function: 0122F290 appears 105 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: String function: 0119B970 appears 280 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: String function: 011E5130 appears 58 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: String function: 0121EA12 appears 86 times
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: String function: 011F7E54 appears 111 times
One or more processes crash
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7488 -s 196
Sample file is different than original file name gathered from version info
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000000.00000002.2174410924.000000000AFE0000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000000.00000000.2120365618.00000000000EE000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameryFh.exe4 vs SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000000.00000002.2150614616.000000000070E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000004.00000002.2324721299.000000000129D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Binary or memory string: OriginalFilenameryFh.exe4 vs SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe
Uses 32bit PE files
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Yara signature match
Source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.2323640935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, Y0QMpp7GltVGNGcM2H.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, Y0QMpp7GltVGNGcM2H.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, Y0QMpp7GltVGNGcM2H.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: _0020.AddAccessRule
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: _0020.SetAccessControl
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, VNF4MWeh92ShIOP8do.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/11@0/0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\SysWOW64\WerFault.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess7488
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7496:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_kdo5bcnf.dck.ps1 Jump to behavior
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.83%
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe ReversingLabs: Detection: 42%
Source: unknown Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 7488 -s 196
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: iconcodecservice.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wntdll.pdbUGP source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000004.00000002.2324721299.0000000001170000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000004.00000002.2324721299.0000000001170000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, VNF4MWeh92ShIOP8do.cs .Net Code: YpirbxuScY System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, VNF4MWeh92ShIOP8do.cs .Net Code: YpirbxuScY System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.66d0000.2.raw.unpack, Uo.cs .Net Code: _202A_202E_206E_206A_202B_206A_200E_200D_206F_200D_200C_200B_206E_202C_202B_200E_206A_202D_202A_202C_202E_206B_202C_202E_202D_206F_206C_200E_202D_206B_202D_206D_202A_200C_200C_200B_200C_202B_200D_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, VNF4MWeh92ShIOP8do.cs .Net Code: YpirbxuScY System.Reflection.Assembly.Load(byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_0236F550 pushfd ; iretd 0_2_0236F551
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_04A79A27 push eax; mov dword ptr [esp], ecx 0_2_04A79A3C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_04A79A38 push eax; mov dword ptr [esp], ecx 0_2_04A79A3C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 0_2_06705420 push eax; ret 0_2_06705471
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0040D8C8 push 972ADD89h; iretd 4_2_0040D8CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0041A971 push 00000009h; ret 4_2_0041A973
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0040DA23 pushfd ; retf 4_2_0040DA27
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00414B4D push esp; retf 4_2_00414B50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0041EBBB push esi; ret 4_2_0041EBC4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_00403420 push eax; ret 4_2_00403422
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0041AD97 push ecx; iretd 4_2_0041AD9E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0040559E push ss; ret 4_2_004055A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0040D67A push ss; retf 4_2_0040D68B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0117225F pushad ; ret 4_2_011727F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011727FA pushad ; ret 4_2_011727F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A09AD push ecx; mov dword ptr [esp], ecx 4_2_011A09B6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0117283D push eax; iretd 4_2_01172858
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01171368 push eax; iretd 4_2_01171369
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Static PE information: section name: .text entropy: 7.742217988561948
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, sb5O4APMHUbym2IPVG.cs High entropy of concatenated method names: 't2wEYseYK3', 'qfqEAKCPen', 'QM5E2Q7Yfa', 'N382DORZSU', 'dmv2zbhIId', 'jNREwSRQh4', 'hwLEsqOmlw', 'nKUEhybE0e', 'tDHEL32Xo0', 'xcyErQbdv4'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, zOO3CtswNsC6jq7TXtK.cs High entropy of concatenated method names: 'RhoV3WaOHM', 'z6WV5DhckA', 'QUcVb10dM2', 'OFwVKyHZPp', 'h27V8ShDP9', 'DP8VmcujZB', 'kSQV0yJYNF', 'XZuV7imZ3h', 'b7nVl7XlFm', 'OYxVG9JbuF'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, G9RqyIDvACLSEGupQL.cs High entropy of concatenated method names: 'IkLVsfCWiK', 'cckVL3c6s2', 'XfAVrYfZ3j', 'YOAVYsPNiW', 'uR8Vufj2gX', 'nQDVBvW53R', 'BAkV2NGmsg', 'UqZvx51KCa', 'cKrvHQHGBS', 'Lp6vSjIVTL'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, Rm6b1JuHcrPRFhSGDO.cs High entropy of concatenated method names: 'Dispose', 'MhisSS02ph', 'T3Bhn1YbKn', 'E278864FX2', 'abNsDK8grn', 'Eyjszx9QpF', 'ProcessDialogKey', 'eUahwWdTWJ', 'EQWhsQER3v', 'bh6hh99Rqy'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, zStm1nkMY8iMwdAk3C.cs High entropy of concatenated method names: 'TqBoR7t3qs', 'EqZoM911ik', 'ToString', 'JFOoY0ohDG', 'Tlqoul3ZfD', 'fdDoAELde3', 'PuCoB5sH1d', 'Mgwo2fDgIP', 'rwMoEB3WF9', 'jxKoeOgpTK'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, YDoIkiFiqJm8mdpx11.cs High entropy of concatenated method names: 'GZVt7q5k01', 'LnCtl1hrLy', 'A4st91qIlI', 'lI0tncky8i', 'qdJtCUXCbG', 'svxtObsZLe', 'tlLtPboewn', 'AHntjPNw05', 'D1otXEAkHq', 'Fhqtfh5XrA'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, ComJEZqfwaU7rZ1inN.cs High entropy of concatenated method names: 'OrFE3mt74x', 'lAXE5uCCot', 'iYYEbbmByZ', 'JsMEKQLxSy', 'O3jE8vPMPq', 'BCyEmRmWJ6', 'tTME035GSg', 'ExhE7nDq6V', 'LNtElhbW5w', 'f1DEGSFDfY'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, Ap5wgMzLX2HSSE1Pjo.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vuBVtnXrkC', 'EhuVNiMxdt', 'FRYVa8conx', 'e7UVoFfQ0G', 'pnUVvqL9Nq', 'l42VVhQKph', 'JypVJ8DJdu'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, VWCpvbrqAwcj2DEtrX.cs High entropy of concatenated method names: 'wbDsE0QMpp', 'FltseVGNGc', 'riSsRD2mxX', 'kkPsMwENNt', 'BTysNboOKQ', 'QrHsaB0XTh', 'IOjbc7weOj5vC9xXwD', 'LlDjoMUlZXfEoQ94UF', 'BiTssexxp4', 'eqGsLewCYk'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, uMNat4sLnShqGfWtMuh.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'maWJcQM79J', 'JYlJZWoGQ0', 'HqmJdjM1UG', 'YGdJkpJKaq', 'XKLJg5q4mL', 'LNjJW5BhmH', 'JUXJxIy1sd'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, Y0QMpp7GltVGNGcM2H.cs High entropy of concatenated method names: 'IQYucDfxlZ', 'H0IuZ1TgNw', 'NS1udOYeKS', 'wWnukF4QlP', 'YdsugUeWZl', 'ubXuWcdTLk', 'cucuxGkBFm', 'wSWuHg0nIE', 'dVHuSgZno3', 'hDquDKAIdM'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, D7kgDvliSD2mxX6kPw.cs High entropy of concatenated method names: 'z2EAKoqbnQ', 'ScxAm13xVn', 'NO9A7BBhe3', 'f6TAlTMl4h', 'G0aANG7Qk2', 'e9oAa7m7SH', 'cp3AotqRoP', 'bp9AvGwSic', 'R87AVMYsG7', 'GcTAJWnDw6'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, JKQFrH9B0XTh3kpdI0.cs High entropy of concatenated method names: 'Xmq2TFDjeq', 'y2a2uak7H0', 'FgO2ByMeKL', 'TQ12Escu5s', 'wsW2e2Cf0s', 'qAIBgArkgM', 'pV6BWEvsHR', 'ADIBx2CIDw', 'DyrBHThD1U', 'zt9BS5rd4o'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, abHGTecpKW7m1Dv49Y.cs High entropy of concatenated method names: 'kLgNXGGIJ5', 'FGENiZaue8', 'l21NchMPed', 'LgKNZy6YlE', 'FLLNnyRSQp', 'YaKNQ6CMFx', 'ERoNC8NNrv', 'oX1NO1cSfR', 'YBKNIynMLC', 'zQiNP4BbgY'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, pWdTWJSlQWQER3vsh6.cs High entropy of concatenated method names: 'FhCv93Y2MZ', 'Kn2vn3xgSh', 'W2LvQE2a8Y', 'aWVvCdYj3g', 'dcsvc934jh', 'NAsvOesyCj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, VNF4MWeh92ShIOP8do.cs High entropy of concatenated method names: 'LwrLTMqeuP', 'H4VLYGtUem', 'J4iLup8gqM', 'qtILAr0Evy', 'hsCLBBXKmE', 'nhmL2i9br4', 'ouELEIr5Va', 'O63LesDhQl', 'Bi6L6fqOL9', 'NL1LRGvlrr'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, zNK8grHn7yjx9QpFTU.cs High entropy of concatenated method names: 'tdgvYSCu3k', 'EjHvuVInPV', 'N5mvAYqeQp', 'yhevBbb9ZW', 'vhPv276E89', 'u22vE66GPi', 'KAqveeHQ1Z', 'OMhv6WWCvd', 'ASkvR66xp4', 'TthvM989sO'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, TvptTVAO9VZVoUhgtW.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rV8hSUiahZ', 'w4GhDHjAV6', 'XcvhzkjeDe', 'Tg7LwEITFm', 'Q93LsnbTxg', 'h1TLhvJ2cF', 'NZMLLQQ5Ym', 'h4X49vMWkhvTT7LZR5Q'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, Uif3MphQZCepuUEvRk.cs High entropy of concatenated method names: 'vGnbncngl', 'KP8K4KShg', 'Xb3mj8Vtr', 'hQ40vrjMT', 'E2xlRJCZr', 'yi1GBUKY2', 'sOh1nltbk674SMhthk', 'fLmSssAcae20rslUTC', 'pOwv9MPjf', 'NkRJfg3aW'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, jNNtuuGB9N5IEmTybo.cs High entropy of concatenated method names: 'vvrB8rZa70', 'GN0B0LHwcw', 'EBpAQW4UDj', 'rnWAC1sebZ', 's5VAORqf77', 'vwbAIleA2E', 'dwvAPPegx4', 'B7YAjG6VRl', 'RtjAqvly19', 'DxxAXUfW8W'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, cyyLulWnJi6R3VWBI5.cs High entropy of concatenated method names: 'IrdoHbvDVy', 'LhvoDiZyiV', 'yBNvw6YFa9', 'jtBvsSmtUK', 'jGoofpr5W4', 'YMfoikFcYj', 'fcIoFtoX85', 'SNsockpxT6', 'NXZoZCVQtl', 'CLOod0agun'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.afe0000.3.raw.unpack, YxGmixddeUtRGBcFVS.cs High entropy of concatenated method names: 'ToString', 'wGgafwTIig', 'ASTanYuLkH', 'ubFaQtYUvh', 'S9qaC0tRjI', 'DARaOP5ew0', 'Fu8aIBoxNe', 'RVkaPYgiiV', 'J6xajLorgD', 'QGbaqr5MRn'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, sb5O4APMHUbym2IPVG.cs High entropy of concatenated method names: 't2wEYseYK3', 'qfqEAKCPen', 'QM5E2Q7Yfa', 'N382DORZSU', 'dmv2zbhIId', 'jNREwSRQh4', 'hwLEsqOmlw', 'nKUEhybE0e', 'tDHEL32Xo0', 'xcyErQbdv4'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, zOO3CtswNsC6jq7TXtK.cs High entropy of concatenated method names: 'RhoV3WaOHM', 'z6WV5DhckA', 'QUcVb10dM2', 'OFwVKyHZPp', 'h27V8ShDP9', 'DP8VmcujZB', 'kSQV0yJYNF', 'XZuV7imZ3h', 'b7nVl7XlFm', 'OYxVG9JbuF'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, G9RqyIDvACLSEGupQL.cs High entropy of concatenated method names: 'IkLVsfCWiK', 'cckVL3c6s2', 'XfAVrYfZ3j', 'YOAVYsPNiW', 'uR8Vufj2gX', 'nQDVBvW53R', 'BAkV2NGmsg', 'UqZvx51KCa', 'cKrvHQHGBS', 'Lp6vSjIVTL'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, Rm6b1JuHcrPRFhSGDO.cs High entropy of concatenated method names: 'Dispose', 'MhisSS02ph', 'T3Bhn1YbKn', 'E278864FX2', 'abNsDK8grn', 'Eyjszx9QpF', 'ProcessDialogKey', 'eUahwWdTWJ', 'EQWhsQER3v', 'bh6hh99Rqy'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, zStm1nkMY8iMwdAk3C.cs High entropy of concatenated method names: 'TqBoR7t3qs', 'EqZoM911ik', 'ToString', 'JFOoY0ohDG', 'Tlqoul3ZfD', 'fdDoAELde3', 'PuCoB5sH1d', 'Mgwo2fDgIP', 'rwMoEB3WF9', 'jxKoeOgpTK'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, YDoIkiFiqJm8mdpx11.cs High entropy of concatenated method names: 'GZVt7q5k01', 'LnCtl1hrLy', 'A4st91qIlI', 'lI0tncky8i', 'qdJtCUXCbG', 'svxtObsZLe', 'tlLtPboewn', 'AHntjPNw05', 'D1otXEAkHq', 'Fhqtfh5XrA'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, ComJEZqfwaU7rZ1inN.cs High entropy of concatenated method names: 'OrFE3mt74x', 'lAXE5uCCot', 'iYYEbbmByZ', 'JsMEKQLxSy', 'O3jE8vPMPq', 'BCyEmRmWJ6', 'tTME035GSg', 'ExhE7nDq6V', 'LNtElhbW5w', 'f1DEGSFDfY'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, Ap5wgMzLX2HSSE1Pjo.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vuBVtnXrkC', 'EhuVNiMxdt', 'FRYVa8conx', 'e7UVoFfQ0G', 'pnUVvqL9Nq', 'l42VVhQKph', 'JypVJ8DJdu'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, VWCpvbrqAwcj2DEtrX.cs High entropy of concatenated method names: 'wbDsE0QMpp', 'FltseVGNGc', 'riSsRD2mxX', 'kkPsMwENNt', 'BTysNboOKQ', 'QrHsaB0XTh', 'IOjbc7weOj5vC9xXwD', 'LlDjoMUlZXfEoQ94UF', 'BiTssexxp4', 'eqGsLewCYk'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, uMNat4sLnShqGfWtMuh.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'maWJcQM79J', 'JYlJZWoGQ0', 'HqmJdjM1UG', 'YGdJkpJKaq', 'XKLJg5q4mL', 'LNjJW5BhmH', 'JUXJxIy1sd'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, Y0QMpp7GltVGNGcM2H.cs High entropy of concatenated method names: 'IQYucDfxlZ', 'H0IuZ1TgNw', 'NS1udOYeKS', 'wWnukF4QlP', 'YdsugUeWZl', 'ubXuWcdTLk', 'cucuxGkBFm', 'wSWuHg0nIE', 'dVHuSgZno3', 'hDquDKAIdM'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, D7kgDvliSD2mxX6kPw.cs High entropy of concatenated method names: 'z2EAKoqbnQ', 'ScxAm13xVn', 'NO9A7BBhe3', 'f6TAlTMl4h', 'G0aANG7Qk2', 'e9oAa7m7SH', 'cp3AotqRoP', 'bp9AvGwSic', 'R87AVMYsG7', 'GcTAJWnDw6'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, JKQFrH9B0XTh3kpdI0.cs High entropy of concatenated method names: 'Xmq2TFDjeq', 'y2a2uak7H0', 'FgO2ByMeKL', 'TQ12Escu5s', 'wsW2e2Cf0s', 'qAIBgArkgM', 'pV6BWEvsHR', 'ADIBx2CIDw', 'DyrBHThD1U', 'zt9BS5rd4o'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, abHGTecpKW7m1Dv49Y.cs High entropy of concatenated method names: 'kLgNXGGIJ5', 'FGENiZaue8', 'l21NchMPed', 'LgKNZy6YlE', 'FLLNnyRSQp', 'YaKNQ6CMFx', 'ERoNC8NNrv', 'oX1NO1cSfR', 'YBKNIynMLC', 'zQiNP4BbgY'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, pWdTWJSlQWQER3vsh6.cs High entropy of concatenated method names: 'FhCv93Y2MZ', 'Kn2vn3xgSh', 'W2LvQE2a8Y', 'aWVvCdYj3g', 'dcsvc934jh', 'NAsvOesyCj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, VNF4MWeh92ShIOP8do.cs High entropy of concatenated method names: 'LwrLTMqeuP', 'H4VLYGtUem', 'J4iLup8gqM', 'qtILAr0Evy', 'hsCLBBXKmE', 'nhmL2i9br4', 'ouELEIr5Va', 'O63LesDhQl', 'Bi6L6fqOL9', 'NL1LRGvlrr'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, zNK8grHn7yjx9QpFTU.cs High entropy of concatenated method names: 'tdgvYSCu3k', 'EjHvuVInPV', 'N5mvAYqeQp', 'yhevBbb9ZW', 'vhPv276E89', 'u22vE66GPi', 'KAqveeHQ1Z', 'OMhv6WWCvd', 'ASkvR66xp4', 'TthvM989sO'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, TvptTVAO9VZVoUhgtW.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rV8hSUiahZ', 'w4GhDHjAV6', 'XcvhzkjeDe', 'Tg7LwEITFm', 'Q93LsnbTxg', 'h1TLhvJ2cF', 'NZMLLQQ5Ym', 'h4X49vMWkhvTT7LZR5Q'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, Uif3MphQZCepuUEvRk.cs High entropy of concatenated method names: 'vGnbncngl', 'KP8K4KShg', 'Xb3mj8Vtr', 'hQ40vrjMT', 'E2xlRJCZr', 'yi1GBUKY2', 'sOh1nltbk674SMhthk', 'fLmSssAcae20rslUTC', 'pOwv9MPjf', 'NkRJfg3aW'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, jNNtuuGB9N5IEmTybo.cs High entropy of concatenated method names: 'vvrB8rZa70', 'GN0B0LHwcw', 'EBpAQW4UDj', 'rnWAC1sebZ', 's5VAORqf77', 'vwbAIleA2E', 'dwvAPPegx4', 'B7YAjG6VRl', 'RtjAqvly19', 'DxxAXUfW8W'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, cyyLulWnJi6R3VWBI5.cs High entropy of concatenated method names: 'IrdoHbvDVy', 'LhvoDiZyiV', 'yBNvw6YFa9', 'jtBvsSmtUK', 'jGoofpr5W4', 'YMfoikFcYj', 'fcIoFtoX85', 'SNsockpxT6', 'NXZoZCVQtl', 'CLOod0agun'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f99ee0.0.raw.unpack, YxGmixddeUtRGBcFVS.cs High entropy of concatenated method names: 'ToString', 'wGgafwTIig', 'ASTanYuLkH', 'ubFaQtYUvh', 'S9qaC0tRjI', 'DARaOP5ew0', 'Fu8aIBoxNe', 'RVkaPYgiiV', 'J6xajLorgD', 'QGbaqr5MRn'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, sb5O4APMHUbym2IPVG.cs High entropy of concatenated method names: 't2wEYseYK3', 'qfqEAKCPen', 'QM5E2Q7Yfa', 'N382DORZSU', 'dmv2zbhIId', 'jNREwSRQh4', 'hwLEsqOmlw', 'nKUEhybE0e', 'tDHEL32Xo0', 'xcyErQbdv4'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, zOO3CtswNsC6jq7TXtK.cs High entropy of concatenated method names: 'RhoV3WaOHM', 'z6WV5DhckA', 'QUcVb10dM2', 'OFwVKyHZPp', 'h27V8ShDP9', 'DP8VmcujZB', 'kSQV0yJYNF', 'XZuV7imZ3h', 'b7nVl7XlFm', 'OYxVG9JbuF'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, G9RqyIDvACLSEGupQL.cs High entropy of concatenated method names: 'IkLVsfCWiK', 'cckVL3c6s2', 'XfAVrYfZ3j', 'YOAVYsPNiW', 'uR8Vufj2gX', 'nQDVBvW53R', 'BAkV2NGmsg', 'UqZvx51KCa', 'cKrvHQHGBS', 'Lp6vSjIVTL'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, Rm6b1JuHcrPRFhSGDO.cs High entropy of concatenated method names: 'Dispose', 'MhisSS02ph', 'T3Bhn1YbKn', 'E278864FX2', 'abNsDK8grn', 'Eyjszx9QpF', 'ProcessDialogKey', 'eUahwWdTWJ', 'EQWhsQER3v', 'bh6hh99Rqy'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, zStm1nkMY8iMwdAk3C.cs High entropy of concatenated method names: 'TqBoR7t3qs', 'EqZoM911ik', 'ToString', 'JFOoY0ohDG', 'Tlqoul3ZfD', 'fdDoAELde3', 'PuCoB5sH1d', 'Mgwo2fDgIP', 'rwMoEB3WF9', 'jxKoeOgpTK'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, YDoIkiFiqJm8mdpx11.cs High entropy of concatenated method names: 'GZVt7q5k01', 'LnCtl1hrLy', 'A4st91qIlI', 'lI0tncky8i', 'qdJtCUXCbG', 'svxtObsZLe', 'tlLtPboewn', 'AHntjPNw05', 'D1otXEAkHq', 'Fhqtfh5XrA'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, ComJEZqfwaU7rZ1inN.cs High entropy of concatenated method names: 'OrFE3mt74x', 'lAXE5uCCot', 'iYYEbbmByZ', 'JsMEKQLxSy', 'O3jE8vPMPq', 'BCyEmRmWJ6', 'tTME035GSg', 'ExhE7nDq6V', 'LNtElhbW5w', 'f1DEGSFDfY'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, Ap5wgMzLX2HSSE1Pjo.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vuBVtnXrkC', 'EhuVNiMxdt', 'FRYVa8conx', 'e7UVoFfQ0G', 'pnUVvqL9Nq', 'l42VVhQKph', 'JypVJ8DJdu'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, VWCpvbrqAwcj2DEtrX.cs High entropy of concatenated method names: 'wbDsE0QMpp', 'FltseVGNGc', 'riSsRD2mxX', 'kkPsMwENNt', 'BTysNboOKQ', 'QrHsaB0XTh', 'IOjbc7weOj5vC9xXwD', 'LlDjoMUlZXfEoQ94UF', 'BiTssexxp4', 'eqGsLewCYk'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, uMNat4sLnShqGfWtMuh.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'maWJcQM79J', 'JYlJZWoGQ0', 'HqmJdjM1UG', 'YGdJkpJKaq', 'XKLJg5q4mL', 'LNjJW5BhmH', 'JUXJxIy1sd'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, Y0QMpp7GltVGNGcM2H.cs High entropy of concatenated method names: 'IQYucDfxlZ', 'H0IuZ1TgNw', 'NS1udOYeKS', 'wWnukF4QlP', 'YdsugUeWZl', 'ubXuWcdTLk', 'cucuxGkBFm', 'wSWuHg0nIE', 'dVHuSgZno3', 'hDquDKAIdM'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, D7kgDvliSD2mxX6kPw.cs High entropy of concatenated method names: 'z2EAKoqbnQ', 'ScxAm13xVn', 'NO9A7BBhe3', 'f6TAlTMl4h', 'G0aANG7Qk2', 'e9oAa7m7SH', 'cp3AotqRoP', 'bp9AvGwSic', 'R87AVMYsG7', 'GcTAJWnDw6'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, JKQFrH9B0XTh3kpdI0.cs High entropy of concatenated method names: 'Xmq2TFDjeq', 'y2a2uak7H0', 'FgO2ByMeKL', 'TQ12Escu5s', 'wsW2e2Cf0s', 'qAIBgArkgM', 'pV6BWEvsHR', 'ADIBx2CIDw', 'DyrBHThD1U', 'zt9BS5rd4o'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, abHGTecpKW7m1Dv49Y.cs High entropy of concatenated method names: 'kLgNXGGIJ5', 'FGENiZaue8', 'l21NchMPed', 'LgKNZy6YlE', 'FLLNnyRSQp', 'YaKNQ6CMFx', 'ERoNC8NNrv', 'oX1NO1cSfR', 'YBKNIynMLC', 'zQiNP4BbgY'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, pWdTWJSlQWQER3vsh6.cs High entropy of concatenated method names: 'FhCv93Y2MZ', 'Kn2vn3xgSh', 'W2LvQE2a8Y', 'aWVvCdYj3g', 'dcsvc934jh', 'NAsvOesyCj', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, VNF4MWeh92ShIOP8do.cs High entropy of concatenated method names: 'LwrLTMqeuP', 'H4VLYGtUem', 'J4iLup8gqM', 'qtILAr0Evy', 'hsCLBBXKmE', 'nhmL2i9br4', 'ouELEIr5Va', 'O63LesDhQl', 'Bi6L6fqOL9', 'NL1LRGvlrr'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, zNK8grHn7yjx9QpFTU.cs High entropy of concatenated method names: 'tdgvYSCu3k', 'EjHvuVInPV', 'N5mvAYqeQp', 'yhevBbb9ZW', 'vhPv276E89', 'u22vE66GPi', 'KAqveeHQ1Z', 'OMhv6WWCvd', 'ASkvR66xp4', 'TthvM989sO'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, TvptTVAO9VZVoUhgtW.cs High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'rV8hSUiahZ', 'w4GhDHjAV6', 'XcvhzkjeDe', 'Tg7LwEITFm', 'Q93LsnbTxg', 'h1TLhvJ2cF', 'NZMLLQQ5Ym', 'h4X49vMWkhvTT7LZR5Q'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, Uif3MphQZCepuUEvRk.cs High entropy of concatenated method names: 'vGnbncngl', 'KP8K4KShg', 'Xb3mj8Vtr', 'hQ40vrjMT', 'E2xlRJCZr', 'yi1GBUKY2', 'sOh1nltbk674SMhthk', 'fLmSssAcae20rslUTC', 'pOwv9MPjf', 'NkRJfg3aW'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, jNNtuuGB9N5IEmTybo.cs High entropy of concatenated method names: 'vvrB8rZa70', 'GN0B0LHwcw', 'EBpAQW4UDj', 'rnWAC1sebZ', 's5VAORqf77', 'vwbAIleA2E', 'dwvAPPegx4', 'B7YAjG6VRl', 'RtjAqvly19', 'DxxAXUfW8W'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, cyyLulWnJi6R3VWBI5.cs High entropy of concatenated method names: 'IrdoHbvDVy', 'LhvoDiZyiV', 'yBNvw6YFa9', 'jtBvsSmtUK', 'jGoofpr5W4', 'YMfoikFcYj', 'fcIoFtoX85', 'SNsockpxT6', 'NXZoZCVQtl', 'CLOod0agun'
Source: 0.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.3f11ec0.1.raw.unpack, YxGmixddeUtRGBcFVS.cs High entropy of concatenated method names: 'ToString', 'wGgafwTIig', 'ASTanYuLkH', 'ubFaQtYUvh', 'S9qaC0tRjI', 'DARaOP5ew0', 'Fu8aIBoxNe', 'RVkaPYgiiV', 'J6xajLorgD', 'QGbaqr5MRn'

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: FAILCRITICALERRORS | NOGPFAULTERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe PID: 7296, type: MEMORYSTR
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: A50000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: 2440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: 4440000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: 8790000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: 7130000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: 9790000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: A790000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: B070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: C070000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: D070000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E096E rdtsc 4_2_011E096E
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5210 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 2130 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe API coverage: 0.3 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe TID: 7316 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7632 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 7620 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Amcache.hve.10.dr Binary or memory string: VMware
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.10.dr Binary or memory string: vmci.syshbin
Source: Amcache.hve.10.dr Binary or memory string: VMware, Inc.
Source: Amcache.hve.10.dr Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.10.dr Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.10.dr Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.10.dr Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.10.dr Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.10.dr Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000000.00000002.2172802423.0000000006763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: _VMware_SATA_CD0
Source: Amcache.hve.10.dr Binary or memory string: vmci.sys
Source: Amcache.hve.10.dr Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.10.dr Binary or memory string: vmci.syshbin`
Source: Amcache.hve.10.dr Binary or memory string: \driver\vmci,\driver\pci
Source: Amcache.hve.10.dr Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.10.dr Binary or memory string: VMware20,1
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.10.dr Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.10.dr Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.10.dr Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.10.dr Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.10.dr Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.10.dr Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.10.dr Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.10.dr Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe, 00000000.00000002.2172802423.0000000006763000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_7
Source: Amcache.hve.10.dr Binary or memory string: vmci.inf_amd64_68ed49469341f563
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process queried: DebugPort Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E096E rdtsc 4_2_011E096E
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2DF0 NtQuerySystemInformation,LdrInitializeThunk, 4_2_011E2DF0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov eax, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov ecx, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov eax, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov eax, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov ecx, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov eax, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov eax, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov ecx, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov eax, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E10E mov ecx, dword ptr fs:[00000030h] 4_2_0124E10E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01260115 mov eax, dword ptr fs:[00000030h] 4_2_01260115
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D0124 mov eax, dword ptr fs:[00000030h] 4_2_011D0124
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124A118 mov ecx, dword ptr fs:[00000030h] 4_2_0124A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124A118 mov eax, dword ptr fs:[00000030h] 4_2_0124A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124A118 mov eax, dword ptr fs:[00000030h] 4_2_0124A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124A118 mov eax, dword ptr fs:[00000030h] 4_2_0124A118
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274164 mov eax, dword ptr fs:[00000030h] 4_2_01274164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274164 mov eax, dword ptr fs:[00000030h] 4_2_01274164
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6154 mov eax, dword ptr fs:[00000030h] 4_2_011A6154
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6154 mov eax, dword ptr fs:[00000030h] 4_2_011A6154
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119C156 mov eax, dword ptr fs:[00000030h] 4_2_0119C156
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01234144 mov eax, dword ptr fs:[00000030h] 4_2_01234144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01234144 mov eax, dword ptr fs:[00000030h] 4_2_01234144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01234144 mov ecx, dword ptr fs:[00000030h] 4_2_01234144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01234144 mov eax, dword ptr fs:[00000030h] 4_2_01234144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01234144 mov eax, dword ptr fs:[00000030h] 4_2_01234144
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01238158 mov eax, dword ptr fs:[00000030h] 4_2_01238158
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119A197 mov eax, dword ptr fs:[00000030h] 4_2_0119A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119A197 mov eax, dword ptr fs:[00000030h] 4_2_0119A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119A197 mov eax, dword ptr fs:[00000030h] 4_2_0119A197
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E0185 mov eax, dword ptr fs:[00000030h] 4_2_011E0185
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01244180 mov eax, dword ptr fs:[00000030h] 4_2_01244180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01244180 mov eax, dword ptr fs:[00000030h] 4_2_01244180
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125C188 mov eax, dword ptr fs:[00000030h] 4_2_0125C188
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125C188 mov eax, dword ptr fs:[00000030h] 4_2_0125C188
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122019F mov eax, dword ptr fs:[00000030h] 4_2_0122019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122019F mov eax, dword ptr fs:[00000030h] 4_2_0122019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122019F mov eax, dword ptr fs:[00000030h] 4_2_0122019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122019F mov eax, dword ptr fs:[00000030h] 4_2_0122019F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012761E5 mov eax, dword ptr fs:[00000030h] 4_2_012761E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012661C3 mov eax, dword ptr fs:[00000030h] 4_2_012661C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012661C3 mov eax, dword ptr fs:[00000030h] 4_2_012661C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D01F8 mov eax, dword ptr fs:[00000030h] 4_2_011D01F8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E1D0 mov eax, dword ptr fs:[00000030h] 4_2_0121E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E1D0 mov eax, dword ptr fs:[00000030h] 4_2_0121E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E1D0 mov ecx, dword ptr fs:[00000030h] 4_2_0121E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E1D0 mov eax, dword ptr fs:[00000030h] 4_2_0121E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E1D0 mov eax, dword ptr fs:[00000030h] 4_2_0121E1D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE016 mov eax, dword ptr fs:[00000030h] 4_2_011BE016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE016 mov eax, dword ptr fs:[00000030h] 4_2_011BE016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE016 mov eax, dword ptr fs:[00000030h] 4_2_011BE016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE016 mov eax, dword ptr fs:[00000030h] 4_2_011BE016
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01236030 mov eax, dword ptr fs:[00000030h] 4_2_01236030
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01224000 mov ecx, dword ptr fs:[00000030h] 4_2_01224000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 mov eax, dword ptr fs:[00000030h] 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 mov eax, dword ptr fs:[00000030h] 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 mov eax, dword ptr fs:[00000030h] 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 mov eax, dword ptr fs:[00000030h] 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 mov eax, dword ptr fs:[00000030h] 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 mov eax, dword ptr fs:[00000030h] 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 mov eax, dword ptr fs:[00000030h] 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01242000 mov eax, dword ptr fs:[00000030h] 4_2_01242000
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119A020 mov eax, dword ptr fs:[00000030h] 4_2_0119A020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119C020 mov eax, dword ptr fs:[00000030h] 4_2_0119C020
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A2050 mov eax, dword ptr fs:[00000030h] 4_2_011A2050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CC073 mov eax, dword ptr fs:[00000030h] 4_2_011CC073
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01226050 mov eax, dword ptr fs:[00000030h] 4_2_01226050
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012380A8 mov eax, dword ptr fs:[00000030h] 4_2_012380A8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A208A mov eax, dword ptr fs:[00000030h] 4_2_011A208A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012660B8 mov eax, dword ptr fs:[00000030h] 4_2_012660B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012660B8 mov ecx, dword ptr fs:[00000030h] 4_2_012660B8
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011980A0 mov eax, dword ptr fs:[00000030h] 4_2_011980A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012260E0 mov eax, dword ptr fs:[00000030h] 4_2_012260E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119C0F0 mov eax, dword ptr fs:[00000030h] 4_2_0119C0F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E20F0 mov ecx, dword ptr fs:[00000030h] 4_2_011E20F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A80E9 mov eax, dword ptr fs:[00000030h] 4_2_011A80E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119A0E3 mov ecx, dword ptr fs:[00000030h] 4_2_0119A0E3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012220DE mov eax, dword ptr fs:[00000030h] 4_2_012220DE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01278324 mov eax, dword ptr fs:[00000030h] 4_2_01278324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01278324 mov ecx, dword ptr fs:[00000030h] 4_2_01278324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01278324 mov eax, dword ptr fs:[00000030h] 4_2_01278324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01278324 mov eax, dword ptr fs:[00000030h] 4_2_01278324
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119C310 mov ecx, dword ptr fs:[00000030h] 4_2_0119C310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C0310 mov ecx, dword ptr fs:[00000030h] 4_2_011C0310
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA30B mov eax, dword ptr fs:[00000030h] 4_2_011DA30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA30B mov eax, dword ptr fs:[00000030h] 4_2_011DA30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA30B mov eax, dword ptr fs:[00000030h] 4_2_011DA30B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124437C mov eax, dword ptr fs:[00000030h] 4_2_0124437C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0127634F mov eax, dword ptr fs:[00000030h] 4_2_0127634F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01222349 mov eax, dword ptr fs:[00000030h] 4_2_01222349
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126A352 mov eax, dword ptr fs:[00000030h] 4_2_0126A352
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01248350 mov ecx, dword ptr fs:[00000030h] 4_2_01248350
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122035C mov eax, dword ptr fs:[00000030h] 4_2_0122035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122035C mov eax, dword ptr fs:[00000030h] 4_2_0122035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122035C mov eax, dword ptr fs:[00000030h] 4_2_0122035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122035C mov ecx, dword ptr fs:[00000030h] 4_2_0122035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122035C mov eax, dword ptr fs:[00000030h] 4_2_0122035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122035C mov eax, dword ptr fs:[00000030h] 4_2_0122035C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01198397 mov eax, dword ptr fs:[00000030h] 4_2_01198397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01198397 mov eax, dword ptr fs:[00000030h] 4_2_01198397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01198397 mov eax, dword ptr fs:[00000030h] 4_2_01198397
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119E388 mov eax, dword ptr fs:[00000030h] 4_2_0119E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119E388 mov eax, dword ptr fs:[00000030h] 4_2_0119E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119E388 mov eax, dword ptr fs:[00000030h] 4_2_0119E388
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C438F mov eax, dword ptr fs:[00000030h] 4_2_011C438F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C438F mov eax, dword ptr fs:[00000030h] 4_2_011C438F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA3C0 mov eax, dword ptr fs:[00000030h] 4_2_011AA3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA3C0 mov eax, dword ptr fs:[00000030h] 4_2_011AA3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA3C0 mov eax, dword ptr fs:[00000030h] 4_2_011AA3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA3C0 mov eax, dword ptr fs:[00000030h] 4_2_011AA3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA3C0 mov eax, dword ptr fs:[00000030h] 4_2_011AA3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA3C0 mov eax, dword ptr fs:[00000030h] 4_2_011AA3C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A83C0 mov eax, dword ptr fs:[00000030h] 4_2_011A83C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A83C0 mov eax, dword ptr fs:[00000030h] 4_2_011A83C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A83C0 mov eax, dword ptr fs:[00000030h] 4_2_011A83C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A83C0 mov eax, dword ptr fs:[00000030h] 4_2_011A83C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D63FF mov eax, dword ptr fs:[00000030h] 4_2_011D63FF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012263C0 mov eax, dword ptr fs:[00000030h] 4_2_012263C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125C3CD mov eax, dword ptr fs:[00000030h] 4_2_0125C3CD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE3F0 mov eax, dword ptr fs:[00000030h] 4_2_011BE3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE3F0 mov eax, dword ptr fs:[00000030h] 4_2_011BE3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE3F0 mov eax, dword ptr fs:[00000030h] 4_2_011BE3F0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012443D4 mov eax, dword ptr fs:[00000030h] 4_2_012443D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012443D4 mov eax, dword ptr fs:[00000030h] 4_2_012443D4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B03E9 mov eax, dword ptr fs:[00000030h] 4_2_011B03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B03E9 mov eax, dword ptr fs:[00000030h] 4_2_011B03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B03E9 mov eax, dword ptr fs:[00000030h] 4_2_011B03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B03E9 mov eax, dword ptr fs:[00000030h] 4_2_011B03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B03E9 mov eax, dword ptr fs:[00000030h] 4_2_011B03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B03E9 mov eax, dword ptr fs:[00000030h] 4_2_011B03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B03E9 mov eax, dword ptr fs:[00000030h] 4_2_011B03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B03E9 mov eax, dword ptr fs:[00000030h] 4_2_011B03E9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E3DB mov eax, dword ptr fs:[00000030h] 4_2_0124E3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E3DB mov eax, dword ptr fs:[00000030h] 4_2_0124E3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E3DB mov ecx, dword ptr fs:[00000030h] 4_2_0124E3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124E3DB mov eax, dword ptr fs:[00000030h] 4_2_0124E3DB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119823B mov eax, dword ptr fs:[00000030h] 4_2_0119823B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6259 mov eax, dword ptr fs:[00000030h] 4_2_011A6259
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119A250 mov eax, dword ptr fs:[00000030h] 4_2_0119A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01250274 mov eax, dword ptr fs:[00000030h] 4_2_01250274
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01228243 mov eax, dword ptr fs:[00000030h] 4_2_01228243
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01228243 mov ecx, dword ptr fs:[00000030h] 4_2_01228243
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119826B mov eax, dword ptr fs:[00000030h] 4_2_0119826B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125A250 mov eax, dword ptr fs:[00000030h] 4_2_0125A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125A250 mov eax, dword ptr fs:[00000030h] 4_2_0125A250
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A4260 mov eax, dword ptr fs:[00000030h] 4_2_011A4260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A4260 mov eax, dword ptr fs:[00000030h] 4_2_011A4260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A4260 mov eax, dword ptr fs:[00000030h] 4_2_011A4260
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0127625D mov eax, dword ptr fs:[00000030h] 4_2_0127625D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012362A0 mov eax, dword ptr fs:[00000030h] 4_2_012362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012362A0 mov ecx, dword ptr fs:[00000030h] 4_2_012362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012362A0 mov eax, dword ptr fs:[00000030h] 4_2_012362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012362A0 mov eax, dword ptr fs:[00000030h] 4_2_012362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012362A0 mov eax, dword ptr fs:[00000030h] 4_2_012362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012362A0 mov eax, dword ptr fs:[00000030h] 4_2_012362A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE284 mov eax, dword ptr fs:[00000030h] 4_2_011DE284
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE284 mov eax, dword ptr fs:[00000030h] 4_2_011DE284
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01220283 mov eax, dword ptr fs:[00000030h] 4_2_01220283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01220283 mov eax, dword ptr fs:[00000030h] 4_2_01220283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01220283 mov eax, dword ptr fs:[00000030h] 4_2_01220283
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B02A0 mov eax, dword ptr fs:[00000030h] 4_2_011B02A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B02A0 mov eax, dword ptr fs:[00000030h] 4_2_011B02A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA2C3 mov eax, dword ptr fs:[00000030h] 4_2_011AA2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA2C3 mov eax, dword ptr fs:[00000030h] 4_2_011AA2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA2C3 mov eax, dword ptr fs:[00000030h] 4_2_011AA2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA2C3 mov eax, dword ptr fs:[00000030h] 4_2_011AA2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA2C3 mov eax, dword ptr fs:[00000030h] 4_2_011AA2C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012762D6 mov eax, dword ptr fs:[00000030h] 4_2_012762D6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B02E1 mov eax, dword ptr fs:[00000030h] 4_2_011B02E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B02E1 mov eax, dword ptr fs:[00000030h] 4_2_011B02E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B02E1 mov eax, dword ptr fs:[00000030h] 4_2_011B02E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE53E mov eax, dword ptr fs:[00000030h] 4_2_011CE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE53E mov eax, dword ptr fs:[00000030h] 4_2_011CE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE53E mov eax, dword ptr fs:[00000030h] 4_2_011CE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE53E mov eax, dword ptr fs:[00000030h] 4_2_011CE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE53E mov eax, dword ptr fs:[00000030h] 4_2_011CE53E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01236500 mov eax, dword ptr fs:[00000030h] 4_2_01236500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274500 mov eax, dword ptr fs:[00000030h] 4_2_01274500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274500 mov eax, dword ptr fs:[00000030h] 4_2_01274500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274500 mov eax, dword ptr fs:[00000030h] 4_2_01274500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274500 mov eax, dword ptr fs:[00000030h] 4_2_01274500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274500 mov eax, dword ptr fs:[00000030h] 4_2_01274500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274500 mov eax, dword ptr fs:[00000030h] 4_2_01274500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274500 mov eax, dword ptr fs:[00000030h] 4_2_01274500
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0535 mov eax, dword ptr fs:[00000030h] 4_2_011B0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0535 mov eax, dword ptr fs:[00000030h] 4_2_011B0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0535 mov eax, dword ptr fs:[00000030h] 4_2_011B0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0535 mov eax, dword ptr fs:[00000030h] 4_2_011B0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0535 mov eax, dword ptr fs:[00000030h] 4_2_011B0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0535 mov eax, dword ptr fs:[00000030h] 4_2_011B0535
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A8550 mov eax, dword ptr fs:[00000030h] 4_2_011A8550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A8550 mov eax, dword ptr fs:[00000030h] 4_2_011A8550
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D656A mov eax, dword ptr fs:[00000030h] 4_2_011D656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D656A mov eax, dword ptr fs:[00000030h] 4_2_011D656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D656A mov eax, dword ptr fs:[00000030h] 4_2_011D656A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE59C mov eax, dword ptr fs:[00000030h] 4_2_011DE59C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012205A7 mov eax, dword ptr fs:[00000030h] 4_2_012205A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012205A7 mov eax, dword ptr fs:[00000030h] 4_2_012205A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012205A7 mov eax, dword ptr fs:[00000030h] 4_2_012205A7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D4588 mov eax, dword ptr fs:[00000030h] 4_2_011D4588
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A2582 mov eax, dword ptr fs:[00000030h] 4_2_011A2582
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A2582 mov ecx, dword ptr fs:[00000030h] 4_2_011A2582
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C45B1 mov eax, dword ptr fs:[00000030h] 4_2_011C45B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C45B1 mov eax, dword ptr fs:[00000030h] 4_2_011C45B1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A65D0 mov eax, dword ptr fs:[00000030h] 4_2_011A65D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA5D0 mov eax, dword ptr fs:[00000030h] 4_2_011DA5D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA5D0 mov eax, dword ptr fs:[00000030h] 4_2_011DA5D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE5CF mov eax, dword ptr fs:[00000030h] 4_2_011DE5CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE5CF mov eax, dword ptr fs:[00000030h] 4_2_011DE5CF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DC5ED mov eax, dword ptr fs:[00000030h] 4_2_011DC5ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DC5ED mov eax, dword ptr fs:[00000030h] 4_2_011DC5ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A25E0 mov eax, dword ptr fs:[00000030h] 4_2_011A25E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE5E7 mov eax, dword ptr fs:[00000030h] 4_2_011CE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE5E7 mov eax, dword ptr fs:[00000030h] 4_2_011CE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE5E7 mov eax, dword ptr fs:[00000030h] 4_2_011CE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE5E7 mov eax, dword ptr fs:[00000030h] 4_2_011CE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE5E7 mov eax, dword ptr fs:[00000030h] 4_2_011CE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE5E7 mov eax, dword ptr fs:[00000030h] 4_2_011CE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE5E7 mov eax, dword ptr fs:[00000030h] 4_2_011CE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE5E7 mov eax, dword ptr fs:[00000030h] 4_2_011CE5E7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01226420 mov eax, dword ptr fs:[00000030h] 4_2_01226420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01226420 mov eax, dword ptr fs:[00000030h] 4_2_01226420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01226420 mov eax, dword ptr fs:[00000030h] 4_2_01226420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01226420 mov eax, dword ptr fs:[00000030h] 4_2_01226420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01226420 mov eax, dword ptr fs:[00000030h] 4_2_01226420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01226420 mov eax, dword ptr fs:[00000030h] 4_2_01226420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01226420 mov eax, dword ptr fs:[00000030h] 4_2_01226420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D8402 mov eax, dword ptr fs:[00000030h] 4_2_011D8402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D8402 mov eax, dword ptr fs:[00000030h] 4_2_011D8402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D8402 mov eax, dword ptr fs:[00000030h] 4_2_011D8402
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA430 mov eax, dword ptr fs:[00000030h] 4_2_011DA430
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119E420 mov eax, dword ptr fs:[00000030h] 4_2_0119E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119E420 mov eax, dword ptr fs:[00000030h] 4_2_0119E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119E420 mov eax, dword ptr fs:[00000030h] 4_2_0119E420
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119C427 mov eax, dword ptr fs:[00000030h] 4_2_0119C427
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122C460 mov ecx, dword ptr fs:[00000030h] 4_2_0122C460
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119645D mov eax, dword ptr fs:[00000030h] 4_2_0119645D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C245A mov eax, dword ptr fs:[00000030h] 4_2_011C245A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE443 mov eax, dword ptr fs:[00000030h] 4_2_011DE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE443 mov eax, dword ptr fs:[00000030h] 4_2_011DE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE443 mov eax, dword ptr fs:[00000030h] 4_2_011DE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE443 mov eax, dword ptr fs:[00000030h] 4_2_011DE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE443 mov eax, dword ptr fs:[00000030h] 4_2_011DE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE443 mov eax, dword ptr fs:[00000030h] 4_2_011DE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE443 mov eax, dword ptr fs:[00000030h] 4_2_011DE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DE443 mov eax, dword ptr fs:[00000030h] 4_2_011DE443
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CA470 mov eax, dword ptr fs:[00000030h] 4_2_011CA470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CA470 mov eax, dword ptr fs:[00000030h] 4_2_011CA470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CA470 mov eax, dword ptr fs:[00000030h] 4_2_011CA470
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125A456 mov eax, dword ptr fs:[00000030h] 4_2_0125A456
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122A4B0 mov eax, dword ptr fs:[00000030h] 4_2_0122A4B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D44B0 mov ecx, dword ptr fs:[00000030h] 4_2_011D44B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A64AB mov eax, dword ptr fs:[00000030h] 4_2_011A64AB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0125A49A mov eax, dword ptr fs:[00000030h] 4_2_0125A49A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A04E5 mov ecx, dword ptr fs:[00000030h] 4_2_011A04E5
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A0710 mov eax, dword ptr fs:[00000030h] 4_2_011A0710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D0710 mov eax, dword ptr fs:[00000030h] 4_2_011D0710
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121C730 mov eax, dword ptr fs:[00000030h] 4_2_0121C730
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DC700 mov eax, dword ptr fs:[00000030h] 4_2_011DC700
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D273C mov eax, dword ptr fs:[00000030h] 4_2_011D273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D273C mov ecx, dword ptr fs:[00000030h] 4_2_011D273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D273C mov eax, dword ptr fs:[00000030h] 4_2_011D273C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DC720 mov eax, dword ptr fs:[00000030h] 4_2_011DC720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DC720 mov eax, dword ptr fs:[00000030h] 4_2_011DC720
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A0750 mov eax, dword ptr fs:[00000030h] 4_2_011A0750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2750 mov eax, dword ptr fs:[00000030h] 4_2_011E2750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2750 mov eax, dword ptr fs:[00000030h] 4_2_011E2750
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D674D mov esi, dword ptr fs:[00000030h] 4_2_011D674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D674D mov eax, dword ptr fs:[00000030h] 4_2_011D674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D674D mov eax, dword ptr fs:[00000030h] 4_2_011D674D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A8770 mov eax, dword ptr fs:[00000030h] 4_2_011A8770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0770 mov eax, dword ptr fs:[00000030h] 4_2_011B0770
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01224755 mov eax, dword ptr fs:[00000030h] 4_2_01224755
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122E75D mov eax, dword ptr fs:[00000030h] 4_2_0122E75D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012547A0 mov eax, dword ptr fs:[00000030h] 4_2_012547A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124678E mov eax, dword ptr fs:[00000030h] 4_2_0124678E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A07AF mov eax, dword ptr fs:[00000030h] 4_2_011A07AF
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122E7E1 mov eax, dword ptr fs:[00000030h] 4_2_0122E7E1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AC7C0 mov eax, dword ptr fs:[00000030h] 4_2_011AC7C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A47FB mov eax, dword ptr fs:[00000030h] 4_2_011A47FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A47FB mov eax, dword ptr fs:[00000030h] 4_2_011A47FB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012207C3 mov eax, dword ptr fs:[00000030h] 4_2_012207C3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C27ED mov eax, dword ptr fs:[00000030h] 4_2_011C27ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C27ED mov eax, dword ptr fs:[00000030h] 4_2_011C27ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C27ED mov eax, dword ptr fs:[00000030h] 4_2_011C27ED
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E2619 mov eax, dword ptr fs:[00000030h] 4_2_011E2619
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B260B mov eax, dword ptr fs:[00000030h] 4_2_011B260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B260B mov eax, dword ptr fs:[00000030h] 4_2_011B260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B260B mov eax, dword ptr fs:[00000030h] 4_2_011B260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B260B mov eax, dword ptr fs:[00000030h] 4_2_011B260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B260B mov eax, dword ptr fs:[00000030h] 4_2_011B260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B260B mov eax, dword ptr fs:[00000030h] 4_2_011B260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B260B mov eax, dword ptr fs:[00000030h] 4_2_011B260B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E609 mov eax, dword ptr fs:[00000030h] 4_2_0121E609
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A262C mov eax, dword ptr fs:[00000030h] 4_2_011A262C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BE627 mov eax, dword ptr fs:[00000030h] 4_2_011BE627
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D6620 mov eax, dword ptr fs:[00000030h] 4_2_011D6620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D8620 mov eax, dword ptr fs:[00000030h] 4_2_011D8620
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126866E mov eax, dword ptr fs:[00000030h] 4_2_0126866E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126866E mov eax, dword ptr fs:[00000030h] 4_2_0126866E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011BC640 mov eax, dword ptr fs:[00000030h] 4_2_011BC640
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D2674 mov eax, dword ptr fs:[00000030h] 4_2_011D2674
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA660 mov eax, dword ptr fs:[00000030h] 4_2_011DA660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA660 mov eax, dword ptr fs:[00000030h] 4_2_011DA660
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A4690 mov eax, dword ptr fs:[00000030h] 4_2_011A4690
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A4690 mov eax, dword ptr fs:[00000030h] 4_2_011A4690
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D66B0 mov eax, dword ptr fs:[00000030h] 4_2_011D66B0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DC6A6 mov eax, dword ptr fs:[00000030h] 4_2_011DC6A6
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E6F2 mov eax, dword ptr fs:[00000030h] 4_2_0121E6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E6F2 mov eax, dword ptr fs:[00000030h] 4_2_0121E6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E6F2 mov eax, dword ptr fs:[00000030h] 4_2_0121E6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E6F2 mov eax, dword ptr fs:[00000030h] 4_2_0121E6F2
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012206F1 mov eax, dword ptr fs:[00000030h] 4_2_012206F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012206F1 mov eax, dword ptr fs:[00000030h] 4_2_012206F1
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA6C7 mov ebx, dword ptr fs:[00000030h] 4_2_011DA6C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA6C7 mov eax, dword ptr fs:[00000030h] 4_2_011DA6C7
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01198918 mov eax, dword ptr fs:[00000030h] 4_2_01198918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01198918 mov eax, dword ptr fs:[00000030h] 4_2_01198918
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122892A mov eax, dword ptr fs:[00000030h] 4_2_0122892A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0123892B mov eax, dword ptr fs:[00000030h] 4_2_0123892B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E908 mov eax, dword ptr fs:[00000030h] 4_2_0121E908
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121E908 mov eax, dword ptr fs:[00000030h] 4_2_0121E908
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122C912 mov eax, dword ptr fs:[00000030h] 4_2_0122C912
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01244978 mov eax, dword ptr fs:[00000030h] 4_2_01244978
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01244978 mov eax, dword ptr fs:[00000030h] 4_2_01244978
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122C97C mov eax, dword ptr fs:[00000030h] 4_2_0122C97C
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01220946 mov eax, dword ptr fs:[00000030h] 4_2_01220946
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274940 mov eax, dword ptr fs:[00000030h] 4_2_01274940
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E096E mov eax, dword ptr fs:[00000030h] 4_2_011E096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E096E mov edx, dword ptr fs:[00000030h] 4_2_011E096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011E096E mov eax, dword ptr fs:[00000030h] 4_2_011E096E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C6962 mov eax, dword ptr fs:[00000030h] 4_2_011C6962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C6962 mov eax, dword ptr fs:[00000030h] 4_2_011C6962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C6962 mov eax, dword ptr fs:[00000030h] 4_2_011C6962
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012289B3 mov esi, dword ptr fs:[00000030h] 4_2_012289B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012289B3 mov eax, dword ptr fs:[00000030h] 4_2_012289B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012289B3 mov eax, dword ptr fs:[00000030h] 4_2_012289B3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A09AD mov eax, dword ptr fs:[00000030h] 4_2_011A09AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A09AD mov eax, dword ptr fs:[00000030h] 4_2_011A09AD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B29A0 mov eax, dword ptr fs:[00000030h] 4_2_011B29A0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122E9E0 mov eax, dword ptr fs:[00000030h] 4_2_0122E9E0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA9D0 mov eax, dword ptr fs:[00000030h] 4_2_011AA9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA9D0 mov eax, dword ptr fs:[00000030h] 4_2_011AA9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA9D0 mov eax, dword ptr fs:[00000030h] 4_2_011AA9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA9D0 mov eax, dword ptr fs:[00000030h] 4_2_011AA9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA9D0 mov eax, dword ptr fs:[00000030h] 4_2_011AA9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AA9D0 mov eax, dword ptr fs:[00000030h] 4_2_011AA9D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D49D0 mov eax, dword ptr fs:[00000030h] 4_2_011D49D0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012369C0 mov eax, dword ptr fs:[00000030h] 4_2_012369C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D29F9 mov eax, dword ptr fs:[00000030h] 4_2_011D29F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D29F9 mov eax, dword ptr fs:[00000030h] 4_2_011D29F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126A9D3 mov eax, dword ptr fs:[00000030h] 4_2_0126A9D3
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124483A mov eax, dword ptr fs:[00000030h] 4_2_0124483A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124483A mov eax, dword ptr fs:[00000030h] 4_2_0124483A
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C2835 mov eax, dword ptr fs:[00000030h] 4_2_011C2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C2835 mov eax, dword ptr fs:[00000030h] 4_2_011C2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C2835 mov eax, dword ptr fs:[00000030h] 4_2_011C2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C2835 mov ecx, dword ptr fs:[00000030h] 4_2_011C2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C2835 mov eax, dword ptr fs:[00000030h] 4_2_011C2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C2835 mov eax, dword ptr fs:[00000030h] 4_2_011C2835
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DA830 mov eax, dword ptr fs:[00000030h] 4_2_011DA830
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122C810 mov eax, dword ptr fs:[00000030h] 4_2_0122C810
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A4859 mov eax, dword ptr fs:[00000030h] 4_2_011A4859
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A4859 mov eax, dword ptr fs:[00000030h] 4_2_011A4859
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D0854 mov eax, dword ptr fs:[00000030h] 4_2_011D0854
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122E872 mov eax, dword ptr fs:[00000030h] 4_2_0122E872
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122E872 mov eax, dword ptr fs:[00000030h] 4_2_0122E872
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01236870 mov eax, dword ptr fs:[00000030h] 4_2_01236870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01236870 mov eax, dword ptr fs:[00000030h] 4_2_01236870
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B2840 mov ecx, dword ptr fs:[00000030h] 4_2_011B2840
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A0887 mov eax, dword ptr fs:[00000030h] 4_2_011A0887
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122C89D mov eax, dword ptr fs:[00000030h] 4_2_0122C89D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126A8E4 mov eax, dword ptr fs:[00000030h] 4_2_0126A8E4
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CE8C0 mov eax, dword ptr fs:[00000030h] 4_2_011CE8C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DC8F9 mov eax, dword ptr fs:[00000030h] 4_2_011DC8F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DC8F9 mov eax, dword ptr fs:[00000030h] 4_2_011DC8F9
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_012708C0 mov eax, dword ptr fs:[00000030h] 4_2_012708C0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01268B28 mov eax, dword ptr fs:[00000030h] 4_2_01268B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01268B28 mov eax, dword ptr fs:[00000030h] 4_2_01268B28
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274B00 mov eax, dword ptr fs:[00000030h] 4_2_01274B00
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121EB1D mov eax, dword ptr fs:[00000030h] 4_2_0121EB1D
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CEB20 mov eax, dword ptr fs:[00000030h] 4_2_011CEB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CEB20 mov eax, dword ptr fs:[00000030h] 4_2_011CEB20
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01198B50 mov eax, dword ptr fs:[00000030h] 4_2_01198B50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01236B40 mov eax, dword ptr fs:[00000030h] 4_2_01236B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01236B40 mov eax, dword ptr fs:[00000030h] 4_2_01236B40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0126AB40 mov eax, dword ptr fs:[00000030h] 4_2_0126AB40
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01248B42 mov eax, dword ptr fs:[00000030h] 4_2_01248B42
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0119CB7E mov eax, dword ptr fs:[00000030h] 4_2_0119CB7E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01254B4B mov eax, dword ptr fs:[00000030h] 4_2_01254B4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01254B4B mov eax, dword ptr fs:[00000030h] 4_2_01254B4B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01272B57 mov eax, dword ptr fs:[00000030h] 4_2_01272B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01272B57 mov eax, dword ptr fs:[00000030h] 4_2_01272B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01272B57 mov eax, dword ptr fs:[00000030h] 4_2_01272B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01272B57 mov eax, dword ptr fs:[00000030h] 4_2_01272B57
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124EB50 mov eax, dword ptr fs:[00000030h] 4_2_0124EB50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01254BB0 mov eax, dword ptr fs:[00000030h] 4_2_01254BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01254BB0 mov eax, dword ptr fs:[00000030h] 4_2_01254BB0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0BBE mov eax, dword ptr fs:[00000030h] 4_2_011B0BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0BBE mov eax, dword ptr fs:[00000030h] 4_2_011B0BBE
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122CBF0 mov eax, dword ptr fs:[00000030h] 4_2_0122CBF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C0BCB mov eax, dword ptr fs:[00000030h] 4_2_011C0BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C0BCB mov eax, dword ptr fs:[00000030h] 4_2_011C0BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C0BCB mov eax, dword ptr fs:[00000030h] 4_2_011C0BCB
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A0BCD mov eax, dword ptr fs:[00000030h] 4_2_011A0BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A0BCD mov eax, dword ptr fs:[00000030h] 4_2_011A0BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A0BCD mov eax, dword ptr fs:[00000030h] 4_2_011A0BCD
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CEBFC mov eax, dword ptr fs:[00000030h] 4_2_011CEBFC
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A8BF0 mov eax, dword ptr fs:[00000030h] 4_2_011A8BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A8BF0 mov eax, dword ptr fs:[00000030h] 4_2_011A8BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A8BF0 mov eax, dword ptr fs:[00000030h] 4_2_011A8BF0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124EBD0 mov eax, dword ptr fs:[00000030h] 4_2_0124EBD0
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DCA38 mov eax, dword ptr fs:[00000030h] 4_2_011DCA38
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C4A35 mov eax, dword ptr fs:[00000030h] 4_2_011C4A35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011C4A35 mov eax, dword ptr fs:[00000030h] 4_2_011C4A35
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011CEA2E mov eax, dword ptr fs:[00000030h] 4_2_011CEA2E
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0122CA11 mov eax, dword ptr fs:[00000030h] 4_2_0122CA11
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DCA24 mov eax, dword ptr fs:[00000030h] 4_2_011DCA24
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0A5B mov eax, dword ptr fs:[00000030h] 4_2_011B0A5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011B0A5B mov eax, dword ptr fs:[00000030h] 4_2_011B0A5B
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0124EA60 mov eax, dword ptr fs:[00000030h] 4_2_0124EA60
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6A50 mov eax, dword ptr fs:[00000030h] 4_2_011A6A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6A50 mov eax, dword ptr fs:[00000030h] 4_2_011A6A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6A50 mov eax, dword ptr fs:[00000030h] 4_2_011A6A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6A50 mov eax, dword ptr fs:[00000030h] 4_2_011A6A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6A50 mov eax, dword ptr fs:[00000030h] 4_2_011A6A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6A50 mov eax, dword ptr fs:[00000030h] 4_2_011A6A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011A6A50 mov eax, dword ptr fs:[00000030h] 4_2_011A6A50
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121CA72 mov eax, dword ptr fs:[00000030h] 4_2_0121CA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_0121CA72 mov eax, dword ptr fs:[00000030h] 4_2_0121CA72
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DCA6F mov eax, dword ptr fs:[00000030h] 4_2_011DCA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DCA6F mov eax, dword ptr fs:[00000030h] 4_2_011DCA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011DCA6F mov eax, dword ptr fs:[00000030h] 4_2_011DCA6F
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011D8A90 mov edx, dword ptr fs:[00000030h] 4_2_011D8A90
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_011AEA80 mov eax, dword ptr fs:[00000030h] 4_2_011AEA80
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Code function: 4_2_01274A80 mov eax, dword ptr fs:[00000030h] 4_2_01274A80
Enables debug privileges
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe"
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe" Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Memory written: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe base: 400000 value starts with: 4D5A Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe" Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Process created: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe "C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe" Jump to behavior
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Queries volume information: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1865.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior
AV process strings found (often used to terminate AV products)
Source: Amcache.hve.10.dr Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.10.dr Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.2323640935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 4.2.SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000004.00000002.2323640935.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 1544699 Sample: SecuriteInfo.com.Trojan.Pac... Startdate: 29/10/2024 Architecture: WINDOWS Score: 100 24 Malicious sample detected (through community Yara rule) 2->24 26 Multi AV Scanner detection for submitted file 2->26 28 Yara detected FormBook 2->28 30 5 other signatures 2->30 7 SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe 4 2->7         started        process3 file4 22 SecuriteInfo.com.T...5.6094.2443.exe.log, ASCII 7->22 dropped 32 Adds a directory exclusion to Windows Defender 7->32 34 Injects a PE file into a foreign processes 7->34 11 powershell.exe 23 7->11         started        14 SecuriteInfo.com.Trojan.PackedNET.3095.6094.2443.exe 7->14         started        signatures5 process6 signatures7 36 Loading BitLocker PowerShell Module 11->36 16 WmiPrvSE.exe 11->16         started        18 conhost.exe 11->18         started        20 WerFault.exe 23 16 14->20         started        process8
⊘No contacted IP infos

Contacted Domains

Name IP Active
bg.microsoft.map.fastly.net 199.232.214.172 true