Windows Analysis Report
tnbws7pyQvMUSjF.exe

Overview

General Information

Sample name: tnbws7pyQvMUSjF.exe
Analysis ID: 1527842
MD5: 17a1259bd9c1cb80ac8d105d513bed7f
SHA1: cae2ad2f6a8055ad2145e25324d29033fe1133ae
SHA256: 03b5cfab3f0ffdf96e415006004be9a0c05e6365e1d5834984cfd5cea9df85fe
Tags: exeuser-adrian__luca
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected AntiVM3
Yara detected FormBook
.NET source code contains potential unpacker
AI detected suspicious sample
Adds a directory exclusion to Windows Defender
C2 URLs / IPs found in malware configuration
Found direct / indirect Syscall (likely to bypass EDR)
Injects a PE file into a foreign processes
Loading BitLocker PowerShell Module
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Performs DNS queries to domains with low reputation
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Sigma detected: CMSTP Execution Process Creation
Sigma detected: Powershell Base64 Encoded MpPreference Cmdlet
Switches to a custom stack to bypass stack traces
Tries to detect virtualization through RDTSC time measurements
Tries to resolve many domain names, but no domain seems valid
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Sigma detected: Powershell Defender Exclusion
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Uses 32bit PE files
Uses a Windows Living Off The Land Binaries (LOL bins)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Antivirus / Scanner detection for submitted sample
Source: tnbws7pyQvMUSjF.exe Avira: detected
Found malware configuration
Source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.xhibitonenotary.info/t18n/"], "decoy": ["tmusicoregon.net", "atici.online", "j7u7.xyz", "iewunucierwuerwnziqi1.info", "ruvabetgiris.website", "acik.lat", "obsk.top", "sphaltpaving-ttp1-shd-us-2.shop", "ispensarynearme.news", "b3nd.bond", "urelook.xyz", "gearlpfbm.top", "aconstructionjob.bond", "killsnexis.info", "oshon.xyz", "ashabsxw.top", "ussiatraiding.buzz", "raipsehumus.homes", "6ae23rx.forum", "edar88vvip.shop", "47-nurse-92864.bond", "p4g6.xyz", "kymacaw.net", "amedepot.shop", "hekindclub.net", "remiumpetsupplies.net", "enisekran.xyz", "pacerpa.shop", "milelab.pro", "mlibertypac.net", "yflume.net", "lecrtort.net", "destramentoemcasa.shop", "atubri.info", "hop-gb.sbs", "entalcar-onlineservices.lol", "aylocnuocionkiem.website", "oliticsclickour.xyz", "eo-company-abc.online", "efoplin.xyz", "ndisec.net", "ain-relief-728.xyz", "essislotgoal14.xyz", "1ngg4hdiwt5.shop", "avada-ga-20.press", "earing-tests-49842.bond", "dnusaunni05.sbs", "sim-for-travel.today", "lotehupi.shop", "bresz.xyz", "ozyjtmt.christmas", "awersip.xyz", "unihbahis.net", "ndustrialrichmond.best", "isdom-sol.xyz", "iden-paaaa.buzz", "32xa544mg.autos", "ental-health-89041.bond", "uylevothyroxine.online", "olar-installer-job-at-de2.today", "usiness-phone-systems-6543.bond", "77.info", "enaydereli.xyz", "pjn.xxx"]}
Multi AV Scanner detection for submitted file
Source: tnbws7pyQvMUSjF.exe ReversingLabs: Detection: 60%
Source: tnbws7pyQvMUSjF.exe Virustotal: Detection: 66% Perma Link
Yara detected FormBook
Source: Yara match File source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
AI detected suspicious sample
Source: Submited Sample Integrated Neural Analysis Model: Matched 100.0% probability
Machine Learning detection for sample
Source: tnbws7pyQvMUSjF.exe Joe Sandbox ML: detected
Uses 32bit PE files
Source: tnbws7pyQvMUSjF.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Source: tnbws7pyQvMUSjF.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: cmstp.pdbGCTL source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1472918784.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp, tnbws7pyQvMUSjF.exe, 00000006.00000002.1474929284.0000000002F30000.00000040.10000000.00040000.00000000.sdmp, cmstp.exe, 00000009.00000002.3847506565.0000000000400000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: ckcA.pdb source: tnbws7pyQvMUSjF.exe
Source: Binary string: wntdll.pdbUGP source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1473207542.0000000001240000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000003.1475234081.0000000004A1C000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.3848544185.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.3848544185.0000000004D6E000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000003.1472898863.0000000004865000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: tnbws7pyQvMUSjF.exe, tnbws7pyQvMUSjF.exe, 00000006.00000002.1473207542.0000000001240000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000009.00000003.1475234081.0000000004A1C000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.3848544185.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.3848544185.0000000004D6E000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000003.1472898863.0000000004865000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ckcA.pdbSHA256 source: tnbws7pyQvMUSjF.exe
Source: Binary string: cmstp.pdb source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1472918784.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp, tnbws7pyQvMUSjF.exe, 00000006.00000002.1474929284.0000000002F30000.00000040.10000000.00040000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000009.00000002.3847506565.0000000000400000.00000040.80000000.00040000.00000000.sdmp
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040894B memset,memset,memset,SHGetFolderPathW,memset,SHGetFolderPathW,CmFree,memset,FindFirstFileW,GetLastError,memset,memset,FindNextFileW,FindClose, 9_2_0040894B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040B3C4 memset,GetPrivateProfileStringW,FindFirstFileW,memset,FindNextFileW, 9_2_0040B3C4
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 4x nop then pop esi 6_2_004172E6
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 4x nop then pop ebx 6_2_00407B23
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop esi 9_2_02D072E6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop ebx 9_2_02CF7B23

Networking
barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.xhibitonenotary.info/t18n/
Performs DNS queries to domains with low reputation
Source: DNS query: www.urelook.xyz
Source: DNS query: www.essislotgoal14.xyz
Tries to resolve many domain names, but no domain seems valid
Source: unknown DNS traffic detected: query: www.ruvabetgiris.website replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.aylocnuocionkiem.website replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.milelab.pro replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.gearlpfbm.top replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.xhibitonenotary.info replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.6ae23rx.forum replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.urelook.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.essislotgoal14.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.dnusaunni05.sbs replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.lecrtort.net replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.destramentoemcasa.shop replaycode: Name error (3)
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: www.ruvabetgiris.website replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.aylocnuocionkiem.website replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.milelab.pro replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.gearlpfbm.top replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.xhibitonenotary.info replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.6ae23rx.forum replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.urelook.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.essislotgoal14.xyz replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.dnusaunni05.sbs replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.lecrtort.net replaycode: Name error (3)
Source: unknown DNS traffic detected: query: www.destramentoemcasa.shop replaycode: Name error (3)
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic DNS traffic detected: DNS query: www.ruvabetgiris.website
Source: global traffic DNS traffic detected: DNS query: www.urelook.xyz
Source: global traffic DNS traffic detected: DNS query: www.6ae23rx.forum
Source: global traffic DNS traffic detected: DNS query: www.gearlpfbm.top
Source: global traffic DNS traffic detected: DNS query: www.xhibitonenotary.info
Source: global traffic DNS traffic detected: DNS query: www.aylocnuocionkiem.website
Source: global traffic DNS traffic detected: DNS query: www.milelab.pro
Source: global traffic DNS traffic detected: DNS query: www.dnusaunni05.sbs
Source: global traffic DNS traffic detected: DNS query: www.lecrtort.net
Source: global traffic DNS traffic detected: DNS query: www.destramentoemcasa.shop
Source: global traffic DNS traffic detected: DNS query: www.essislotgoal14.xyz
Source: explorer.exe, 00000007.00000003.2285772758.0000000009264000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3854658121.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076254780.0000000009264000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000091FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://cacerts.digicert.com/DigiCertGlobalRootG2.crt0
Source: explorer.exe, 00000007.00000003.2285772758.0000000009264000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3854658121.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076254780.0000000009264000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000091FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl3.digicert.com/DigiCertGlobalRootG2.crl07
Source: explorer.exe, 00000007.00000002.3854658121.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2285772758.0000000009264000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076935292.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3854658121.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076254780.0000000009264000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.0000000009237000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://crl4.digicert.com/DigiCertGlobalRootG2.crl0
Source: explorer.exe, 00000007.00000000.1413529906.0000000004405000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3849810107.0000000004405000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ns.adobeS
Source: explorer.exe, 00000007.00000003.2285772758.0000000009264000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3854658121.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076254780.0000000009264000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000091FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.com0
Source: explorer.exe, 00000007.00000002.3854031180.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000090DA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://ocsp.digicert.comhttp://crl3.digicert.com/DigiCertGlobalRootG2.crlhttp://crl4.digicert.com/Di
Source: explorer.exe, 00000007.00000000.1417862053.0000000007720000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1417841209.0000000007710000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000000.1411129106.0000000002C80000.00000002.00000001.00040000.00000000.sdmp String found in binary or memory: http://schemas.micro
Source: tnbws7pyQvMUSjF.exe, 00000000.00000002.1411362800.00000000031E6000.00000004.00000800.00020000.00000000.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.6ae23rx.forum
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.6ae23rx.forum/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.6ae23rx.forum/t18n/www.gearlpfbm.top
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.6ae23rx.forumReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aylocnuocionkiem.website
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aylocnuocionkiem.website/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aylocnuocionkiem.website/t18n/www.milelab.pro
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.aylocnuocionkiem.websiteReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bresz.xyz
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bresz.xyz/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bresz.xyz/t18n/www.urelook.xyz
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.bresz.xyzReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.destramentoemcasa.shop
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.destramentoemcasa.shop/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.destramentoemcasa.shop/t18n/www.essislotgoal14.xyz
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.destramentoemcasa.shopReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dnusaunni05.sbs
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dnusaunni05.sbs/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dnusaunni05.sbs/t18n/www.lecrtort.net
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.dnusaunni05.sbsReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.enisekran.xyz
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.enisekran.xyz/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.enisekran.xyz/t18n/www.ozyjtmt.christmas
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.enisekran.xyzReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.essislotgoal14.xyz
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.essislotgoal14.xyz/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.essislotgoal14.xyz/t18n/www.enisekran.xyz
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.essislotgoal14.xyzReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gearlpfbm.top
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gearlpfbm.top/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gearlpfbm.top/t18n/www.xhibitonenotary.info
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.gearlpfbm.topReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lecrtort.net
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lecrtort.net/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lecrtort.net/t18n/www.destramentoemcasa.shop
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lecrtort.netReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lotehupi.shop
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lotehupi.shop/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lotehupi.shop/t18n/www.sphaltpaving-ttp1-shd-us-2.shop
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.lotehupi.shopReferer:
Source: explorer.exe, 00000007.00000002.3854658121.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076935292.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.0000000009237000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.0000000009237000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.microsoft.c
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.milelab.pro
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.milelab.pro/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.milelab.pro/t18n/www.dnusaunni05.sbs
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.milelab.proReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ozyjtmt.christmas
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ozyjtmt.christmas/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ozyjtmt.christmas/t18n/www.lotehupi.shop
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ozyjtmt.christmasReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ruvabetgiris.website
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ruvabetgiris.website/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ruvabetgiris.website/t18n/www.bresz.xyz
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.ruvabetgiris.websiteReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sphaltpaving-ttp1-shd-us-2.shop
Source: explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sphaltpaving-ttp1-shd-us-2.shop/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.sphaltpaving-ttp1-shd-us-2.shopReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.urelook.xyz
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.urelook.xyz/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.urelook.xyz/t18n/www.6ae23rx.forum
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.urelook.xyzReferer:
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.xhibitonenotary.info
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.xhibitonenotary.info/t18n/
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.xhibitonenotary.info/t18n/www.aylocnuocionkiem.website
Source: explorer.exe, 00000007.00000003.2286972160.000000000C133000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3859530494.000000000C127000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3078507753.000000000C132000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: http://www.xhibitonenotary.infoReferer:
Source: explorer.exe, 00000007.00000002.3857695739.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1426705990.000000000BC80000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://activity.windows.com/UserActivity.ReadWrite.CreatedByApp
Source: explorer.exe, 00000007.00000002.3857695739.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1426705990.000000000BC80000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOS
Source: explorer.exe, 00000007.00000002.3857695739.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1426705990.000000000BC80000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOSA4
Source: explorer.exe, 00000007.00000002.3857695739.000000000BC80000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1426705990.000000000BC80000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://android.notify.windows.com/iOSd
Source: explorer.exe, 00000007.00000003.2286415291.000000000704B000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3077380643.000000000704E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.000000000702D000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3075985304.000000000704E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3850684822.000000000704E000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/
Source: explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/News/Feed/Windows?apikey=qrUeHGGYvVowZJuHA3XaH0uUvg1ZJ0GUZnXk3mxxPF&ocid=wind
Source: explorer.exe, 00000007.00000002.3854031180.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000090DA000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com/v1/news/Feed/Windows?activityId=0E948A694F8C48079B908C8EA9DDF9EA&timeOut=5000&oc
Source: explorer.exe, 00000007.00000002.3854031180.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://api.msn.com:443/v1/news/Feed/Windows?
Source: explorer.exe, 00000007.00000002.3854031180.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000091FB000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000091FB000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://arc.msn.com
Source: explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/finance/1stparty/FinanceTaskbarIcons/Finance_Earnings
Source: explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Condition/MostlyClearNight.svg
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/Icons/JyNGQgA=/Teaser/recordhigh.svg
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://assets.msn.com/weathermapdata/1/static/weather/taskbar/animation/WeatherInsights/WeatherInsi
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13f2DV-dark
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13fcaT-dark
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gF9k-dark
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://cdn.query.prod.cms.msn.com/cms/api/amp/binary/AA13gKBA-dark
Source: explorer.exe, 00000007.00000000.1426705990.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3857695739.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://excel.office.com
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA11f7Wa.img
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA15Yat4.img
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1b2aMG.img
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1bjET8.img
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AA1hGNsX.img
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/AAT0qC2.img
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBNvr53.img
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://img-s-msn-com.akamaized.net/tenant/amp/entityid/BBYTL1i.img
Source: explorer.exe, 00000007.00000000.1426705990.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3857695739.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://outlook.com
Source: explorer.exe, 00000007.00000000.1426705990.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3857695739.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://powerpoint.office.comer
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://upload.wikimedia.org/wikipedia/commons/thumb/8/84/Zealandia-Continent_map_en.svg/1870px-Zeal
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shell?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://windows.msn.com:443/shellv2?osLocale=en-GB&chosenMarketReason=ImplicitNew
Source: explorer.exe, 00000007.00000000.1426705990.000000000BDF5000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://wns.windows.com/EM0
Source: explorer.exe, 00000007.00000000.1426705990.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3857695739.000000000BBB0000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://word.office.com48
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/careersandeducation/student-loan-debt-forgiveness-arrives-for-some-b
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/markets/costco-is-seeing-a-gold-rush-what-s-behind-the-demand-for-it
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-big-3-mistakes-financial-advisors-say-that-the-1
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/money/personalfinance/the-no-1-phrase-people-who-are-good-at-small-talk-al
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/politics/kinzinger-has-theory-about-who-next-house-speaker-will-be/vi
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/news/us/dumb-and-dumber-12-states-with-the-absolute-worst-education-in-the
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/sports/other/predicting-what-the-pac-12-would-look-like-after-expansion-wi
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/sports/other/simone-biles-leads-u-s-women-s-team-to-seventh-straight-world
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/sports/other/washington-state-ad-asks-ncaa-for-compassion-and-understandin
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/accuweather-el-ni
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/first-map-of-earth-s-lost-continent-has-been-published/
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/stop-planting-new-forests-scientists-say/ar-AA1hFI09
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com/en-us/weather/topstories/us-winter-forecast-for-the-2023-2024-season/ar-AA1hGINt
Source: explorer.exe, 00000007.00000002.3850684822.0000000006F09000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1414665064.0000000006F0F000.00000004.00000001.00020000.00000000.sdmp String found in binary or memory: https://www.msn.com:443/en-us/feed

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: Process Memory Space: tnbws7pyQvMUSjF.exe PID: 7664, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: tnbws7pyQvMUSjF.exe PID: 7856, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: Process Memory Space: cmstp.exe PID: 8172, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041A330 NtCreateFile, 6_2_0041A330
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041A3E0 NtReadFile, 6_2_0041A3E0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041A460 NtClose, 6_2_0041A460
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041A510 NtAllocateVirtualMemory, 6_2_0041A510
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041A3DD NtReadFile, 6_2_0041A3DD
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041A382 NtCreateFile, 6_2_0041A382
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041A45A NtClose, 6_2_0041A45A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041A58B NtAllocateVirtualMemory, 6_2_0041A58B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2B60 NtClose,LdrInitializeThunk, 6_2_012B2B60
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 6_2_012B2BF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2AD0 NtReadFile,LdrInitializeThunk, 6_2_012B2AD0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2D30 NtUnmapViewOfSection,LdrInitializeThunk, 6_2_012B2D30
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2D10 NtMapViewOfSection,LdrInitializeThunk, 6_2_012B2D10
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2DF0 NtQuerySystemInformation,LdrInitializeThunk, 6_2_012B2DF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2DD0 NtDelayExecution,LdrInitializeThunk, 6_2_012B2DD0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2C70 NtFreeVirtualMemory,LdrInitializeThunk, 6_2_012B2C70
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2CA0 NtQueryInformationToken,LdrInitializeThunk, 6_2_012B2CA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2F30 NtCreateSection,LdrInitializeThunk, 6_2_012B2F30
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2FB0 NtResumeThread,LdrInitializeThunk, 6_2_012B2FB0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2F90 NtProtectVirtualMemory,LdrInitializeThunk, 6_2_012B2F90
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2FE0 NtCreateFile,LdrInitializeThunk, 6_2_012B2FE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2EA0 NtAdjustPrivilegesToken,LdrInitializeThunk, 6_2_012B2EA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2E80 NtReadVirtualMemory,LdrInitializeThunk, 6_2_012B2E80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B4340 NtSetContextThread, 6_2_012B4340
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B4650 NtSuspendThread, 6_2_012B4650
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2BA0 NtEnumerateValueKey, 6_2_012B2BA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2B80 NtQueryInformationFile, 6_2_012B2B80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2BE0 NtQueryValueKey, 6_2_012B2BE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2AB0 NtWaitForSingleObject, 6_2_012B2AB0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2AF0 NtWriteFile, 6_2_012B2AF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2D00 NtSetInformationFile, 6_2_012B2D00
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2DB0 NtEnumerateKey, 6_2_012B2DB0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2C00 NtQueryInformationProcess, 6_2_012B2C00
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2C60 NtCreateKey, 6_2_012B2C60
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2CF0 NtOpenProcess, 6_2_012B2CF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2CC0 NtQueryVirtualMemory, 6_2_012B2CC0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2F60 NtCreateProcessEx, 6_2_012B2F60
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2FA0 NtQuerySection, 6_2_012B2FA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2E30 NtWriteVirtualMemory, 6_2_012B2E30
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2EE0 NtQueueApcThread, 6_2_012B2EE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B3010 NtOpenDirectoryObject, 6_2_012B3010
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B3090 NtSetValueKey, 6_2_012B3090
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B35C0 NtCreateMutant, 6_2_012B35C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B39B0 NtGetContextThread, 6_2_012B39B0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B3D10 NtOpenProcessToken, 6_2_012B3D10
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B3D70 NtOpenThread, 6_2_012B3D70
Source: C:\Windows\explorer.exe Code function: 7_2_0E052E12 NtProtectVirtualMemory, 7_2_0E052E12
Source: C:\Windows\explorer.exe Code function: 7_2_0E051232 NtCreateFile, 7_2_0E051232
Source: C:\Windows\explorer.exe Code function: 7_2_0E052E0A NtProtectVirtualMemory, 7_2_0E052E0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42CA0 NtQueryInformationToken,LdrInitializeThunk, 9_2_04C42CA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42C60 NtCreateKey,LdrInitializeThunk, 9_2_04C42C60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42C70 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_04C42C70
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42DD0 NtDelayExecution,LdrInitializeThunk, 9_2_04C42DD0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42DF0 NtQuerySystemInformation,LdrInitializeThunk, 9_2_04C42DF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42D10 NtMapViewOfSection,LdrInitializeThunk, 9_2_04C42D10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42EA0 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_04C42EA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42FE0 NtCreateFile,LdrInitializeThunk, 9_2_04C42FE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42F30 NtCreateSection,LdrInitializeThunk, 9_2_04C42F30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42AD0 NtReadFile,LdrInitializeThunk, 9_2_04C42AD0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42BE0 NtQueryValueKey,LdrInitializeThunk, 9_2_04C42BE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42BF0 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_04C42BF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42B60 NtClose,LdrInitializeThunk, 9_2_04C42B60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C435C0 NtCreateMutant,LdrInitializeThunk, 9_2_04C435C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C44650 NtSuspendThread, 9_2_04C44650
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C44340 NtSetContextThread, 9_2_04C44340
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42CC0 NtQueryVirtualMemory, 9_2_04C42CC0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42CF0 NtOpenProcess, 9_2_04C42CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42C00 NtQueryInformationProcess, 9_2_04C42C00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42DB0 NtEnumerateKey, 9_2_04C42DB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42D00 NtSetInformationFile, 9_2_04C42D00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42D30 NtUnmapViewOfSection, 9_2_04C42D30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42EE0 NtQueueApcThread, 9_2_04C42EE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42E80 NtReadVirtualMemory, 9_2_04C42E80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42E30 NtWriteVirtualMemory, 9_2_04C42E30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42F90 NtProtectVirtualMemory, 9_2_04C42F90
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42FA0 NtQuerySection, 9_2_04C42FA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42FB0 NtResumeThread, 9_2_04C42FB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42F60 NtCreateProcessEx, 9_2_04C42F60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42AF0 NtWriteFile, 9_2_04C42AF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42AB0 NtWaitForSingleObject, 9_2_04C42AB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42B80 NtQueryInformationFile, 9_2_04C42B80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C42BA0 NtEnumerateValueKey, 9_2_04C42BA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C43090 NtSetValueKey, 9_2_04C43090
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C43010 NtOpenDirectoryObject, 9_2_04C43010
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C43D70 NtOpenThread, 9_2_04C43D70
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C43D10 NtOpenProcessToken, 9_2_04C43D10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C439B0 NtGetContextThread, 9_2_04C439B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0A3E0 NtReadFile, 9_2_02D0A3E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0A330 NtCreateFile, 9_2_02D0A330
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0A460 NtClose, 9_2_02D0A460
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0A510 NtAllocateVirtualMemory, 9_2_02D0A510
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0A3DD NtReadFile, 9_2_02D0A3DD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0A382 NtCreateFile, 9_2_02D0A382
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0A45A NtClose, 9_2_02D0A45A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0A58B NtAllocateVirtualMemory, 9_2_02D0A58B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B0A036 NtQueryInformationProcess,NtSuspendThread,NtSetContextThread,NtQueueApcThread,NtResumeThread, 9_2_04B0A036
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B09BAF NtCreateSection,NtMapViewOfSection,NtMapViewOfSection,NtUnmapViewOfSection,NtClose, 9_2_04B09BAF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B0A042 NtQueryInformationProcess, 9_2_04B0A042
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B09BB2 NtCreateSection,NtMapViewOfSection,NtMapViewOfSection, 9_2_04B09BB2
Detected potential crypto function
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0158D5BC 0_2_0158D5BC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05607368 0_2_05607368
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05608250 0_2_05608250
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05605D90 0_2_05605D90
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560AC50 0_2_0560AC50
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560CF78 0_2_0560CF78
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05606900 0_2_05606900
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560A9F8 0_2_0560A9F8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560A57A 0_2_0560A57A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560A588 0_2_0560A588
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560A7E8 0_2_0560A7E8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560A7D8 0_2_0560A7D8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05608160 0_2_05608160
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05609168 0_2_05609168
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560B168 0_2_0560B168
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05609178 0_2_05609178
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560B178 0_2_0560B178
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05605178 0_2_05605178
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05605188 0_2_05605188
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05607359 0_2_05607359
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560A3E8 0_2_0560A3E8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560A3DB 0_2_0560A3DB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560B223 0_2_0560B223
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05609D48 0_2_05609D48
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05605D2B 0_2_05605D2B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05609D39 0_2_05609D39
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560AC40 0_2_0560AC40
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05605CD8 0_2_05605CD8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05608F69 0_2_05608F69
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560CF69 0_2_0560CF69
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_05608F78 0_2_05608F78
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560CF01 0_2_0560CF01
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560DFA8 0_2_0560DFA8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560DF98 0_2_0560DF98
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560A9E8 0_2_0560A9E8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560C9C8 0_2_0560C9C8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560C9B9 0_2_0560C9B9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_056068F1 0_2_056068F1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560DA60 0_2_0560DA60
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_0560DA70 0_2_0560DA70
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074A5738 0_2_074A5738
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074A76B8 0_2_074A76B8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074A4513 0_2_074A4513
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074A5300 0_2_074A5300
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074A52F1 0_2_074A52F1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074A4EC8 0_2_074A4EC8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074A6DE0 0_2_074A6DE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074A08D0 0_2_074A08D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_00401030 6_2_00401030
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041EB99 6_2_0041EB99
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041DC3D 6_2_0041DC3D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041E549 6_2_0041E549
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_00402D90 6_2_00402D90
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_00409E5C 6_2_00409E5C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_00409E60 6_2_00409E60
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041D6BC 6_2_0041D6BC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041DF7D 6_2_0041DF7D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041E7AE 6_2_0041E7AE
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_00402FB0 6_2_00402FB0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270100 6_2_01270100
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131A118 6_2_0131A118
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01308158 6_2_01308158
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013401AA 6_2_013401AA
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013381CC 6_2_013381CC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133A352 6_2_0133A352
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013403E6 6_2_013403E6
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E3F0 6_2_0128E3F0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013002C0 6_2_013002C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280535 6_2_01280535
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01340591 6_2_01340591
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01332446 6_2_01332446
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0132E4F6 6_2_0132E4F6
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A4750 6_2_012A4750
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127C7C0 6_2_0127C7C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129C6E0 6_2_0129C6E0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01296962 6_2_01296962
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0134A9A6 6_2_0134A9A6
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128A840 6_2_0128A840
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01282840 6_2_01282840
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012668B8 6_2_012668B8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE8F0 6_2_012AE8F0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133AB40 6_2_0133AB40
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01336BD7 6_2_01336BD7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128AD00 6_2_0128AD00
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01298DBF 6_2_01298DBF
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127ADE0 6_2_0127ADE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280C00 6_2_01280C00
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320CB5 6_2_01320CB5
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270CF2 6_2_01270CF2
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012C2F28 6_2_012C2F28
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A0F30 6_2_012A0F30
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F4F40 6_2_012F4F40
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FEFA0 6_2_012FEFA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128CFE0 6_2_0128CFE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01272FC8 6_2_01272FC8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133EE26 6_2_0133EE26
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280E59 6_2_01280E59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133CE93 6_2_0133CE93
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01292E90 6_2_01292E90
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133EEDB 6_2_0133EEDB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B516C 6_2_012B516C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126F172 6_2_0126F172
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0134B16B 6_2_0134B16B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128B1B0 6_2_0128B1B0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133F0E0 6_2_0133F0E0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013370E9 6_2_013370E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012870C0 6_2_012870C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0132F0CC 6_2_0132F0CC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133132D 6_2_0133132D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126D34C 6_2_0126D34C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012C739A 6_2_012C739A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012852A0 6_2_012852A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013212ED 6_2_013212ED
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129B2C0 6_2_0129B2C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01337571 6_2_01337571
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131D5B0 6_2_0131D5B0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133F43F 6_2_0133F43F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01271460 6_2_01271460
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133F7B0 6_2_0133F7B0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013316CC 6_2_013316CC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01289950 6_2_01289950
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129B950 6_2_0129B950
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ED800 6_2_012ED800
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012838E0 6_2_012838E0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133FB76 6_2_0133FB76
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129FB80 6_2_0129FB80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012BDBF9 6_2_012BDBF9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F5BF0 6_2_012F5BF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F3A6C 6_2_012F3A6C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01337A46 6_2_01337A46
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133FA49 6_2_0133FA49
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012C5AA0 6_2_012C5AA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131DAAC 6_2_0131DAAC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0132DAC6 6_2_0132DAC6
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01337D73 6_2_01337D73
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01283D40 6_2_01283D40
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01331D5A 6_2_01331D5A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129FDC0 6_2_0129FDC0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F9C32 6_2_012F9C32
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133FCF2 6_2_0133FCF2
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133FF09 6_2_0133FF09
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133FFB1 6_2_0133FFB1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01281F92 6_2_01281F92
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01289EB0 6_2_01289EB0
Source: C:\Windows\explorer.exe Code function: 7_2_0DF455CD 7_2_0DF455CD
Source: C:\Windows\explorer.exe Code function: 7_2_0DF3F912 7_2_0DF3F912
Source: C:\Windows\explorer.exe Code function: 7_2_0DF39D02 7_2_0DF39D02
Source: C:\Windows\explorer.exe Code function: 7_2_0DF38082 7_2_0DF38082
Source: C:\Windows\explorer.exe Code function: 7_2_0DF41036 7_2_0DF41036
Source: C:\Windows\explorer.exe Code function: 7_2_0DF3CB32 7_2_0DF3CB32
Source: C:\Windows\explorer.exe Code function: 7_2_0DF3CB30 7_2_0DF3CB30
Source: C:\Windows\explorer.exe Code function: 7_2_0DF42232 7_2_0DF42232
Source: C:\Windows\explorer.exe Code function: 7_2_0E051232 7_2_0E051232
Source: C:\Windows\explorer.exe Code function: 7_2_0E050036 7_2_0E050036
Source: C:\Windows\explorer.exe Code function: 7_2_0E047082 7_2_0E047082
Source: C:\Windows\explorer.exe Code function: 7_2_0E048D02 7_2_0E048D02
Source: C:\Windows\explorer.exe Code function: 7_2_0E04E912 7_2_0E04E912
Source: C:\Windows\explorer.exe Code function: 7_2_0E04BB30 7_2_0E04BB30
Source: C:\Windows\explorer.exe Code function: 7_2_0E04BB32 7_2_0E04BB32
Source: C:\Windows\explorer.exe Code function: 7_2_0E0545CD 7_2_0E0545CD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040B634 9_2_0040B634
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CBE4F6 9_2_04CBE4F6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC2446 9_2_04CC2446
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CB4420 9_2_04CB4420
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CD0591 9_2_04CD0591
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C10535 9_2_04C10535
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C2C6E0 9_2_04C2C6E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C0C7C0 9_2_04C0C7C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C34750 9_2_04C34750
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C10770 9_2_04C10770
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CA2000 9_2_04CA2000
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC81CC 9_2_04CC81CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CD01AA 9_2_04CD01AA
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC41A2 9_2_04CC41A2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C98158 9_2_04C98158
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C00100 9_2_04C00100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CAA118 9_2_04CAA118
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C902C0 9_2_04C902C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CB0274 9_2_04CB0274
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CD03E6 9_2_04CD03E6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C1E3F0 9_2_04C1E3F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCA352 9_2_04CCA352
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C00CF2 9_2_04C00CF2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CB0CB5 9_2_04CB0CB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C10C00 9_2_04C10C00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C0ADE0 9_2_04C0ADE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C28DBF 9_2_04C28DBF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C1AD00 9_2_04C1AD00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CACD1F 9_2_04CACD1F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCEEDB 9_2_04CCEEDB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C22E90 9_2_04C22E90
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCCE93 9_2_04CCCE93
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C10E59 9_2_04C10E59
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCEE26 9_2_04CCEE26
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C02FC8 9_2_04C02FC8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C1CFE0 9_2_04C1CFE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C8EFA0 9_2_04C8EFA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C84F40 9_2_04C84F40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C52F28 9_2_04C52F28
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C30F30 9_2_04C30F30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CB2F30 9_2_04CB2F30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04BF68B8 9_2_04BF68B8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C3E8F0 9_2_04C3E8F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C1A840 9_2_04C1A840
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C12840 9_2_04C12840
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C129A0 9_2_04C129A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CDA9A6 9_2_04CDA9A6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C26962 9_2_04C26962
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C0EA80 9_2_04C0EA80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC6BD7 9_2_04CC6BD7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCAB40 9_2_04CCAB40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C01460 9_2_04C01460
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCF43F 9_2_04CCF43F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CAD5B0 9_2_04CAD5B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC7571 9_2_04CC7571
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC16CC 9_2_04CC16CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCF7B0 9_2_04CCF7B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C170C0 9_2_04C170C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CBF0CC 9_2_04CBF0CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC70E9 9_2_04CC70E9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCF0E0 9_2_04CCF0E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C1B1B0 9_2_04C1B1B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CDB16B 9_2_04CDB16B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C4516C 9_2_04C4516C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04BFF172 9_2_04BFF172
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C2B2C0 9_2_04C2B2C0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CB12ED 9_2_04CB12ED
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C152A0 9_2_04C152A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C5739A 9_2_04C5739A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC132D 9_2_04CC132D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04BFD34C 9_2_04BFD34C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCFCF2 9_2_04CCFCF2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C89C32 9_2_04C89C32
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C2FDC0 9_2_04C2FDC0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C13D40 9_2_04C13D40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC1D5A 9_2_04CC1D5A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC7D73 9_2_04CC7D73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C19EB0 9_2_04C19EB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C11F92 9_2_04C11F92
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCFFB1 9_2_04CCFFB1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCFF09 9_2_04CCFF09
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C138E0 9_2_04C138E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C7D800 9_2_04C7D800
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C19950 9_2_04C19950
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C2B950 9_2_04C2B950
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CA5910 9_2_04CA5910
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CBDAC6 9_2_04CBDAC6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C55AA0 9_2_04C55AA0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CADAAC 9_2_04CADAAC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CB1AA3 9_2_04CB1AA3
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCFA49 9_2_04CCFA49
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CC7A46 9_2_04CC7A46
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C83A6C 9_2_04C83A6C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C85BF0 9_2_04C85BF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C4DBF9 9_2_04C4DBF9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C2FB80 9_2_04C2FB80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04CCFB76 9_2_04CCFB76
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0E7AE 9_2_02D0E7AE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0E549 9_2_02D0E549
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0EB99 9_2_02D0EB99
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02CF9E5C 9_2_02CF9E5C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02CF9E60 9_2_02CF9E60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02CF2FB0 9_2_02CF2FB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02CF2D90 9_2_02CF2D90
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B0A036 9_2_04B0A036
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B0E5CD 9_2_04B0E5CD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B02D02 9_2_04B02D02
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B01082 9_2_04B01082
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B08912 9_2_04B08912
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B0B232 9_2_04B0B232
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B05B30 9_2_04B05B30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B05B32 9_2_04B05B32
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 04BFB970 appears 280 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 04C8F290 appears 105 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 04C57E54 appears 102 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 0040E951 appears 100 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 04C7EA12 appears 86 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 04C45130 appears 58 times
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: String function: 012EEA12 appears 86 times
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: String function: 0126B970 appears 274 times
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: String function: 012C7E54 appears 99 times
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: String function: 012FF290 appears 105 times
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: String function: 012B5130 appears 37 times
Sample file is different than original file name gathered from version info
Source: tnbws7pyQvMUSjF.exe, 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs tnbws7pyQvMUSjF.exe
Source: tnbws7pyQvMUSjF.exe, 00000000.00000002.1417447158.0000000007420000.00000004.08000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameTyrone.dll8 vs tnbws7pyQvMUSjF.exe
Source: tnbws7pyQvMUSjF.exe, 00000000.00000002.1418137456.0000000007CE0000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamePowerShell.EXE.MUIj% vs tnbws7pyQvMUSjF.exe
Source: tnbws7pyQvMUSjF.exe, 00000000.00000002.1408866168.000000000134E000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameclr.dllT vs tnbws7pyQvMUSjF.exe
Source: tnbws7pyQvMUSjF.exe, 00000000.00000000.1388874936.0000000000BF2000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameckcA.exe@ vs tnbws7pyQvMUSjF.exe
Source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1472918784.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenameCMSTP.EXE` vs tnbws7pyQvMUSjF.exe
Source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1473207542.000000000136D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs tnbws7pyQvMUSjF.exe
Source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1474929284.0000000002F30000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameCMSTP.EXE` vs tnbws7pyQvMUSjF.exe
Source: tnbws7pyQvMUSjF.exe Binary or memory string: OriginalFilenameckcA.exe@ vs tnbws7pyQvMUSjF.exe
Uses 32bit PE files
Source: tnbws7pyQvMUSjF.exe Static PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
Uses a Windows Living Off The Land Binaries (LOL bins)
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe" Jump to behavior
Yara signature match
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: Process Memory Space: tnbws7pyQvMUSjF.exe PID: 7664, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: tnbws7pyQvMUSjF.exe PID: 7856, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: Process Memory Space: cmstp.exe PID: 8172, type: MEMORYSTR Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: tnbws7pyQvMUSjF.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: _0020.SetAccessControl
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: _0020.AddAccessRule
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, q1yRBkpS3y5kP3hRGO.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: _0020.SetAccessControl
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: _0020.AddAccessRule
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, q1yRBkpS3y5kP3hRGO.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, q1yRBkpS3y5kP3hRGO.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: _0020.SetAccessControl
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, y6PHtoxs9c243ifuiW.cs Security API names: _0020.AddAccessRule
Source: classification engine Classification label: mal100.troj.evad.winEXE@14/6@11/0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_00408F05 GetCurrentProcess,OpenProcessToken,GetLastError,LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,InitiateSystemShutdownW,AdjustTokenPrivileges,CloseHandle, 9_2_00408F05
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tnbws7pyQvMUSjF.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Mutant created: NULL
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7240:120:WilError_03
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7848:120:WilError_03
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_3kqi12ac.5ys.ps1 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Command line argument: kernel32.dll 9_2_00406052
Source: tnbws7pyQvMUSjF.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: tnbws7pyQvMUSjF.exe Static file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.80%
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: tnbws7pyQvMUSjF.exe ReversingLabs: Detection: 60%
Source: tnbws7pyQvMUSjF.exe Virustotal: Detection: 66%
Source: cmstp.exe String found in binary or memory: /k certutil.exe -f -enterprise -v -addstore Root "%s"
Source: unknown Process created: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe"
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe"
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe"
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\wbem\WmiPrvSE.exe C:\Windows\system32\wbem\wmiprvse.exe -secured -Embedding
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe"
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe "C:\Windows\SysWOW64\cmstp.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: dwrite.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: windowscodecs.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: edputil.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: windows.staterepositoryps.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: appresolver.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: bcp47langs.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: slc.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: sppc.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: onecorecommonproxystub.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: onecoreuapcommonproxystub.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: atl.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mscoree.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: vcruntime140_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: ucrtbase_clr0400.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: amsi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: msisip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wshext.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: appxsip.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: opcservices.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: secur32.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: microsoft.management.infrastructure.native.unmanaged.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wmidcom.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: windows.cloudstore.schema.shell.dll Jump to behavior
Source: C:\Windows\explorer.exe Section loaded: mfsrcsnk.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: fastprox.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: ncobjapi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wbemcomn.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mpclient.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: wmitomi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: mi.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: miutils.dll Jump to behavior
Source: C:\Windows\System32\wbem\WmiPrvSE.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: cmutil.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: version.dll Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{0EE7644B-1BAD-48B1-9889-0281C206EB85}\InprocServer32 Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: tnbws7pyQvMUSjF.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: tnbws7pyQvMUSjF.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: tnbws7pyQvMUSjF.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: cmstp.pdbGCTL source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1472918784.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp, tnbws7pyQvMUSjF.exe, 00000006.00000002.1474929284.0000000002F30000.00000040.10000000.00040000.00000000.sdmp, cmstp.exe, 00000009.00000002.3847506565.0000000000400000.00000040.80000000.00040000.00000000.sdmp
Source: Binary string: ckcA.pdb source: tnbws7pyQvMUSjF.exe
Source: Binary string: wntdll.pdbUGP source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1473207542.0000000001240000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000003.1475234081.0000000004A1C000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.3848544185.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.3848544185.0000000004D6E000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000003.1472898863.0000000004865000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: tnbws7pyQvMUSjF.exe, tnbws7pyQvMUSjF.exe, 00000006.00000002.1473207542.0000000001240000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000009.00000003.1475234081.0000000004A1C000.00000004.00000020.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.3848544185.0000000004BD0000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000002.3848544185.0000000004D6E000.00000040.00001000.00020000.00000000.sdmp, cmstp.exe, 00000009.00000003.1472898863.0000000004865000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: ckcA.pdbSHA256 source: tnbws7pyQvMUSjF.exe
Source: Binary string: cmstp.pdb source: tnbws7pyQvMUSjF.exe, 00000006.00000002.1472918784.0000000000DE7000.00000004.00000020.00020000.00000000.sdmp, tnbws7pyQvMUSjF.exe, 00000006.00000002.1474929284.0000000002F30000.00000040.10000000.00040000.00000000.sdmp, cmstp.exe, cmstp.exe, 00000009.00000002.3847506565.0000000000400000.00000040.80000000.00040000.00000000.sdmp

Data Obfuscation
barindex
.NET source code contains potential unpacker
Source: tnbws7pyQvMUSjF.exe, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 0.2.tnbws7pyQvMUSjF.exe.402a190.2.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, y6PHtoxs9c243ifuiW.cs .Net Code: pE3psRdgvZ System.Reflection.Assembly.Load(byte[])
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, y6PHtoxs9c243ifuiW.cs .Net Code: pE3psRdgvZ System.Reflection.Assembly.Load(byte[])
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, y6PHtoxs9c243ifuiW.cs .Net Code: pE3psRdgvZ System.Reflection.Assembly.Load(byte[])
Source: 0.2.tnbws7pyQvMUSjF.exe.58c0000.3.raw.unpack, MainForm.cs .Net Code: _200E_200C_200B_202B_202E_200E_200E_202D_200B_206C_202C_202B_200B_200F_200E_206F_206C_202C_202D_200E_206E_206E_200C_206D_202C_200B_200E_202B_200B_206A_202E_206A_202E_206E_206E_206A_206C_206A_206F_202E_202E System.Reflection.Assembly.Load(byte[])
Source: 7.2.explorer.exe.1034f840.0.raw.unpack, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Source: 9.2.cmstp.exe.515f840.3.raw.unpack, Form1.cs .Net Code: InitializeComponent System.AppDomain.Load(byte[])
Binary contains a suspicious time stamp
Source: tnbws7pyQvMUSjF.exe Static PE information: 0xBEAD93A9 [Sun May 17 00:02:49 2071 UTC]
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_056036A0 push eax; ret 0_2_056036A1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_056042F8 pushfd ; retf 0_2_05604301
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_056049F2 pushfd ; iretd 0_2_056049F9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074ACC2D push FFFFFF8Bh; iretd 0_2_074ACC2F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 0_2_074AA9B0 pushfd ; ret 0_2_074AA9B1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041F00F push edi; ret 6_2_0041F011
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_00401174 push ebp; retf 6_2_00401175
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041EB99 push ebp; ret 6_2_0041EE10
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041D4D2 push eax; ret 6_2_0041D4D8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041D4DB push eax; ret 6_2_0041D542
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041D485 push eax; ret 6_2_0041D4D8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041D53C push eax; ret 6_2_0041D542
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0041C6D2 push esp; ret 6_2_0041C6D3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012709AD push ecx; mov dword ptr [esp], ecx 6_2_012709B6
Source: C:\Windows\explorer.exe Code function: 7_2_0DF459B5 push esp; retn 0000h 7_2_0DF45AE7
Source: C:\Windows\explorer.exe Code function: 7_2_0DF45B1E push esp; retn 0000h 7_2_0DF45B1F
Source: C:\Windows\explorer.exe Code function: 7_2_0DF45B02 push esp; retn 0000h 7_2_0DF45B03
Source: C:\Windows\explorer.exe Code function: 7_2_0E054B02 push esp; retn 0000h 7_2_0E054B03
Source: C:\Windows\explorer.exe Code function: 7_2_0E054B1E push esp; retn 0000h 7_2_0E054B1F
Source: C:\Windows\explorer.exe Code function: 7_2_0E0549B5 push esp; retn 0000h 7_2_0E054AE7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_00411A3D push ecx; ret 9_2_00411A50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04C009AD push ecx; mov dword ptr [esp], ecx 9_2_04C009B6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0F00F push edi; ret 9_2_02D0F011
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0C6D2 push esp; ret 9_2_02D0C6D3
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0D4D2 push eax; ret 9_2_02D0D4D8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0D4DB push eax; ret 9_2_02D0D542
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0D485 push eax; ret 9_2_02D0D4D8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0D53C push eax; ret 9_2_02D0D542
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0EB99 push ebp; ret 9_2_02D0EE10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_02D0D91A push esp; ret 9_2_02D0D91B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_04B0E9B5 push esp; retn 0000h 9_2_04B0EAE7
Source: tnbws7pyQvMUSjF.exe Static PE information: section name: .text entropy: 7.434680807200467
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, WX6id07sUvqusiwXCg.cs High entropy of concatenated method names: 'luZ9UAIOPX', 'BRL9Jrw4va', 'eXU9KAgfOb', 'KRl94QHADh', 'cqI9QXxyay', 'hMJ9q99cdj', 'xS59muoDON', 'lXk9VKrnnv', 'rdd9oai2PZ', 'xT69TC8o36'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, lBhxSurWTdsRV4Kif8.cs High entropy of concatenated method names: 'mtO4GEuMWE', 'BEF4BhaOx6', 'Ps7Kaf9OSP', 'RXfK7GjqJN', 'RoeKZ2PgXt', 'zIKKS4g8e7', 'hAFKHnLYfL', 'l0BKEUHhQ7', 'tFQKOGQWuj', 'FXnKDXZ2Lm'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, F8sgaJm1w73yVem1qw.cs High entropy of concatenated method names: 'ToString', 'v6c2x3tica', 'MHC2Ni1M67', 'S4F2ahmjNA', 'JrE27vlPb1', 'P5Y2ZFlnGT', 'U0u2Sv0tEN', 'MLC2Hx7asZ', 'aJO2EXqocX', 'Am52OxG18w'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, DwXbfPJKTvNGH1hoJB.cs High entropy of concatenated method names: 'FSDPqrcFAb', 'anpPmwJf3q', 'VRqPo3B5kG', 'AN4PTwHAse', 'TVNPRoJtLV', 'IBZP2gvNXC', 'C2elJaFQbR2Co4vpKp', 'k31kTVsJHEFRQQL89Y', 'zUjPPtJ05l', 'Ef2PtaVEAI'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, YQTZhXU03VdybrXaA2.cs High entropy of concatenated method names: 'ndcKC3Tk0F', 'UAPKlJUlt7', 'Q4sKdjprsp', 'vnZK8w2AMU', 'tA7KRY8P54', 'z0VK28FmKv', 'XBGKe5D1Jk', 'J6DK9P1xFR', 'GSGKMnljZU', 'JtMKXqe9QD'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, oICLJeKLMeyK81sbtPm.cs High entropy of concatenated method names: 'i7GMfNFjA9', 's59MctoL3Y', 'eX3Ms2LXtK', 'wdGMCqskIY', 'DZ9MGiO2q0', 'SNyMld59l9', 'y26MBpHZ8L', 'ir7MdcIk8M', 'ibxM83jKad', 'gdRMwAQ0vX'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, anZIZUvahbo8m36Em5.cs High entropy of concatenated method names: 'I5XMP1Mt0R', 'aqnMtFTEHX', 'Yn0MpUCHWB', 'PwoMULpEGs', 'vLjMJZ3iti', 'gI4M4NLwLT', 'EomMQcOZa8', 'KEf9b02Hj9', 'tho9yV8a0f', 'zAI9ApuiqF'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, etTXdp1X8V6NlmkcnO.cs High entropy of concatenated method names: 'MWgQ67C9vj', 'b3mQJBrWd2', 'SQwQ4AsUjV', 'RbcQq1NZjG', 'TXeQmfvA2r', 'EuT4gjypA5', 'ni5457DWhu', 'v4q4b81Z92', 'VWk4yKRhQE', 'q3a4A7yXsC'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, d0SNm99VcgUf1Y29Ws.cs High entropy of concatenated method names: 'qmEqUiXd4l', 'HbZqKV4jTV', 'KqEqQ1ZTu9', 'bXKQukgAlx', 'mH7QzOXNTR', 'ni1qIpBvC2', 'WjZqPht2F3', 'Obfq1P2BXE', 'exkqtAfBHa', 'VOEqp7AprD'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, At0mNj5JCKLWRZ41td.cs High entropy of concatenated method names: 'vDjsr003a', 'nSaCr9I5Q', 'JlplCRtNB', 'arZBIZrLs', 'l018DRUpr', 'NEKwI0gvM', 'Sonc55VhgqkQVVgTMr', 'HKK3i3cBJPegqXZXUZ', 'RbK9P9y2P', 'AWjX4b40f'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, jbhJFoOtPd8SynLbCU.cs High entropy of concatenated method names: 'Dispose', 'e5dPAZTLVe', 'BMk1NtZNby', 'zV8LLPPKOt', 'm8YPuQfw5H', 'aQPPzLtfxJ', 'ProcessDialogKey', 'KR81IGvkHI', 'd031P4kvfh', 'rLO11tRpNo'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, YbprunAdej833j571V.cs High entropy of concatenated method names: 'u0LeyfZddb', 'iBNeuy1jNO', 'AOR9I471pR', 'CNr9PelUoh', 'dhAexbkIQ5', 'wfDe0uIM9q', 'P8eeiIsNOr', 'vlHeY7evwv', 'S8CejaB8Md', 'lCfevTyfWV'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, TaAiifNZxnIK0gKrV6.cs High entropy of concatenated method names: 'iiy3dliiv3', 'z7I381E1MN', 'eDi3FsUVeS', 'fy53NlkULf', 'crp37wxRpe', 'AGG3ZYqhfD', 'hLO3HKr5MN', 'fAu3EGgl1Z', 'zEf3DUhYIT', 'YrM3x6589C'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, gxuNj4iueV3QrTrwc7.cs High entropy of concatenated method names: 'nuVqfC9qBY', 'jMKqcagHE9', 'r1rqsK1bWw', 'cfdqCe3GGR', 'we9qGkoP27', 'cOwqliNJRb', 'NFMqBUduCJ', 'A2OqdP59SM', 'wHvq8x09FC', 'a4jqwS0Dd8'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, o0MTSKKweWEVQKjro4x.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RXFXYqT9X4', 'yohXjeKVpj', 'H3oXvMkFhB', 'f9HXre0vSF', 'zynXgrAwnT', 'eW7X5cRf3c', 'kurXb830FI'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, XSuGiCFPwpINIaNj1i.cs High entropy of concatenated method names: 'j65eoI5AVF', 'X0neTi7HIo', 'ToString', 'XwEeUlJX41', 'IfWeJIZVJ1', 'm33eKoJ5aC', 'cFDe4Nx5o9', 'qMIeQl3jWk', 'Ou6eqBfmOf', 'IxMemcGvFw'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, q1yRBkpS3y5kP3hRGO.cs High entropy of concatenated method names: 'VGrJYOUsmF', 'nPSJjo5to2', 'Va1JvRIhoF', 'graJrHeeUl', 'z4cJgL2Hnr', 'gFMJ5pVLjf', 'BP0JbcqOG4', 'nFJJysCZfD', 'pH5JA8U67F', 'JYlJu0vx9g'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, y6PHtoxs9c243ifuiW.cs High entropy of concatenated method names: 'uXXt6LmmkP', 'vE1tUryNm2', 'TLEtJBZr9E', 'uLatKsAAuL', 'noct4NpLX2', 'MNstQVnoiE', 'RfetqMQ5xD', 'BEdtmjIjSX', 'agHtVOGk8D', 'pDMtohGfN0'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, owmcQrfhm38luXPsgX.cs High entropy of concatenated method names: 'z5sRDcTJLV', 'AMTR04YJ70', 'boDRYlNnEw', 'mAPRjOdGsD', 'oNZRN8QFHh', 'fkmRabgVhy', 'zQnR7HTu2v', 'SyyRZQBZdq', 'vaoRSmO72p', 'FXDRHkLSx0'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, DXq8YSG6iTZgiJi4YW.cs High entropy of concatenated method names: 'p8t9FHaZhP', 'MRI9NnEZYq', 'LNd9atNRxZ', 'G1J97VEQ7w', 'BRY9YOTkfj', 'SrC9Zx6s5a', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.tnbws7pyQvMUSjF.exe.7420000.4.raw.unpack, F5G4HpzwED2Rs1Ytvi.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ubFM3qbRRF', 'koJMRrkr7S', 'rWyM2SfbBv', 'f9hMeobkju', 'VU9M9NdJZP', 'wraMMrYgvV', 'eIyMXdiD9j'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, WX6id07sUvqusiwXCg.cs High entropy of concatenated method names: 'luZ9UAIOPX', 'BRL9Jrw4va', 'eXU9KAgfOb', 'KRl94QHADh', 'cqI9QXxyay', 'hMJ9q99cdj', 'xS59muoDON', 'lXk9VKrnnv', 'rdd9oai2PZ', 'xT69TC8o36'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, lBhxSurWTdsRV4Kif8.cs High entropy of concatenated method names: 'mtO4GEuMWE', 'BEF4BhaOx6', 'Ps7Kaf9OSP', 'RXfK7GjqJN', 'RoeKZ2PgXt', 'zIKKS4g8e7', 'hAFKHnLYfL', 'l0BKEUHhQ7', 'tFQKOGQWuj', 'FXnKDXZ2Lm'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, F8sgaJm1w73yVem1qw.cs High entropy of concatenated method names: 'ToString', 'v6c2x3tica', 'MHC2Ni1M67', 'S4F2ahmjNA', 'JrE27vlPb1', 'P5Y2ZFlnGT', 'U0u2Sv0tEN', 'MLC2Hx7asZ', 'aJO2EXqocX', 'Am52OxG18w'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, DwXbfPJKTvNGH1hoJB.cs High entropy of concatenated method names: 'FSDPqrcFAb', 'anpPmwJf3q', 'VRqPo3B5kG', 'AN4PTwHAse', 'TVNPRoJtLV', 'IBZP2gvNXC', 'C2elJaFQbR2Co4vpKp', 'k31kTVsJHEFRQQL89Y', 'zUjPPtJ05l', 'Ef2PtaVEAI'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, YQTZhXU03VdybrXaA2.cs High entropy of concatenated method names: 'ndcKC3Tk0F', 'UAPKlJUlt7', 'Q4sKdjprsp', 'vnZK8w2AMU', 'tA7KRY8P54', 'z0VK28FmKv', 'XBGKe5D1Jk', 'J6DK9P1xFR', 'GSGKMnljZU', 'JtMKXqe9QD'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, oICLJeKLMeyK81sbtPm.cs High entropy of concatenated method names: 'i7GMfNFjA9', 's59MctoL3Y', 'eX3Ms2LXtK', 'wdGMCqskIY', 'DZ9MGiO2q0', 'SNyMld59l9', 'y26MBpHZ8L', 'ir7MdcIk8M', 'ibxM83jKad', 'gdRMwAQ0vX'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, anZIZUvahbo8m36Em5.cs High entropy of concatenated method names: 'I5XMP1Mt0R', 'aqnMtFTEHX', 'Yn0MpUCHWB', 'PwoMULpEGs', 'vLjMJZ3iti', 'gI4M4NLwLT', 'EomMQcOZa8', 'KEf9b02Hj9', 'tho9yV8a0f', 'zAI9ApuiqF'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, etTXdp1X8V6NlmkcnO.cs High entropy of concatenated method names: 'MWgQ67C9vj', 'b3mQJBrWd2', 'SQwQ4AsUjV', 'RbcQq1NZjG', 'TXeQmfvA2r', 'EuT4gjypA5', 'ni5457DWhu', 'v4q4b81Z92', 'VWk4yKRhQE', 'q3a4A7yXsC'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, d0SNm99VcgUf1Y29Ws.cs High entropy of concatenated method names: 'qmEqUiXd4l', 'HbZqKV4jTV', 'KqEqQ1ZTu9', 'bXKQukgAlx', 'mH7QzOXNTR', 'ni1qIpBvC2', 'WjZqPht2F3', 'Obfq1P2BXE', 'exkqtAfBHa', 'VOEqp7AprD'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, At0mNj5JCKLWRZ41td.cs High entropy of concatenated method names: 'vDjsr003a', 'nSaCr9I5Q', 'JlplCRtNB', 'arZBIZrLs', 'l018DRUpr', 'NEKwI0gvM', 'Sonc55VhgqkQVVgTMr', 'HKK3i3cBJPegqXZXUZ', 'RbK9P9y2P', 'AWjX4b40f'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, jbhJFoOtPd8SynLbCU.cs High entropy of concatenated method names: 'Dispose', 'e5dPAZTLVe', 'BMk1NtZNby', 'zV8LLPPKOt', 'm8YPuQfw5H', 'aQPPzLtfxJ', 'ProcessDialogKey', 'KR81IGvkHI', 'd031P4kvfh', 'rLO11tRpNo'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, YbprunAdej833j571V.cs High entropy of concatenated method names: 'u0LeyfZddb', 'iBNeuy1jNO', 'AOR9I471pR', 'CNr9PelUoh', 'dhAexbkIQ5', 'wfDe0uIM9q', 'P8eeiIsNOr', 'vlHeY7evwv', 'S8CejaB8Md', 'lCfevTyfWV'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, TaAiifNZxnIK0gKrV6.cs High entropy of concatenated method names: 'iiy3dliiv3', 'z7I381E1MN', 'eDi3FsUVeS', 'fy53NlkULf', 'crp37wxRpe', 'AGG3ZYqhfD', 'hLO3HKr5MN', 'fAu3EGgl1Z', 'zEf3DUhYIT', 'YrM3x6589C'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, gxuNj4iueV3QrTrwc7.cs High entropy of concatenated method names: 'nuVqfC9qBY', 'jMKqcagHE9', 'r1rqsK1bWw', 'cfdqCe3GGR', 'we9qGkoP27', 'cOwqliNJRb', 'NFMqBUduCJ', 'A2OqdP59SM', 'wHvq8x09FC', 'a4jqwS0Dd8'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, o0MTSKKweWEVQKjro4x.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RXFXYqT9X4', 'yohXjeKVpj', 'H3oXvMkFhB', 'f9HXre0vSF', 'zynXgrAwnT', 'eW7X5cRf3c', 'kurXb830FI'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, XSuGiCFPwpINIaNj1i.cs High entropy of concatenated method names: 'j65eoI5AVF', 'X0neTi7HIo', 'ToString', 'XwEeUlJX41', 'IfWeJIZVJ1', 'm33eKoJ5aC', 'cFDe4Nx5o9', 'qMIeQl3jWk', 'Ou6eqBfmOf', 'IxMemcGvFw'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, q1yRBkpS3y5kP3hRGO.cs High entropy of concatenated method names: 'VGrJYOUsmF', 'nPSJjo5to2', 'Va1JvRIhoF', 'graJrHeeUl', 'z4cJgL2Hnr', 'gFMJ5pVLjf', 'BP0JbcqOG4', 'nFJJysCZfD', 'pH5JA8U67F', 'JYlJu0vx9g'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, y6PHtoxs9c243ifuiW.cs High entropy of concatenated method names: 'uXXt6LmmkP', 'vE1tUryNm2', 'TLEtJBZr9E', 'uLatKsAAuL', 'noct4NpLX2', 'MNstQVnoiE', 'RfetqMQ5xD', 'BEdtmjIjSX', 'agHtVOGk8D', 'pDMtohGfN0'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, owmcQrfhm38luXPsgX.cs High entropy of concatenated method names: 'z5sRDcTJLV', 'AMTR04YJ70', 'boDRYlNnEw', 'mAPRjOdGsD', 'oNZRN8QFHh', 'fkmRabgVhy', 'zQnR7HTu2v', 'SyyRZQBZdq', 'vaoRSmO72p', 'FXDRHkLSx0'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, DXq8YSG6iTZgiJi4YW.cs High entropy of concatenated method names: 'p8t9FHaZhP', 'MRI9NnEZYq', 'LNd9atNRxZ', 'G1J97VEQ7w', 'BRY9YOTkfj', 'SrC9Zx6s5a', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, F5G4HpzwED2Rs1Ytvi.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ubFM3qbRRF', 'koJMRrkr7S', 'rWyM2SfbBv', 'f9hMeobkju', 'VU9M9NdJZP', 'wraMMrYgvV', 'eIyMXdiD9j'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, WX6id07sUvqusiwXCg.cs High entropy of concatenated method names: 'luZ9UAIOPX', 'BRL9Jrw4va', 'eXU9KAgfOb', 'KRl94QHADh', 'cqI9QXxyay', 'hMJ9q99cdj', 'xS59muoDON', 'lXk9VKrnnv', 'rdd9oai2PZ', 'xT69TC8o36'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, lBhxSurWTdsRV4Kif8.cs High entropy of concatenated method names: 'mtO4GEuMWE', 'BEF4BhaOx6', 'Ps7Kaf9OSP', 'RXfK7GjqJN', 'RoeKZ2PgXt', 'zIKKS4g8e7', 'hAFKHnLYfL', 'l0BKEUHhQ7', 'tFQKOGQWuj', 'FXnKDXZ2Lm'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, F8sgaJm1w73yVem1qw.cs High entropy of concatenated method names: 'ToString', 'v6c2x3tica', 'MHC2Ni1M67', 'S4F2ahmjNA', 'JrE27vlPb1', 'P5Y2ZFlnGT', 'U0u2Sv0tEN', 'MLC2Hx7asZ', 'aJO2EXqocX', 'Am52OxG18w'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, DwXbfPJKTvNGH1hoJB.cs High entropy of concatenated method names: 'FSDPqrcFAb', 'anpPmwJf3q', 'VRqPo3B5kG', 'AN4PTwHAse', 'TVNPRoJtLV', 'IBZP2gvNXC', 'C2elJaFQbR2Co4vpKp', 'k31kTVsJHEFRQQL89Y', 'zUjPPtJ05l', 'Ef2PtaVEAI'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, YQTZhXU03VdybrXaA2.cs High entropy of concatenated method names: 'ndcKC3Tk0F', 'UAPKlJUlt7', 'Q4sKdjprsp', 'vnZK8w2AMU', 'tA7KRY8P54', 'z0VK28FmKv', 'XBGKe5D1Jk', 'J6DK9P1xFR', 'GSGKMnljZU', 'JtMKXqe9QD'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, oICLJeKLMeyK81sbtPm.cs High entropy of concatenated method names: 'i7GMfNFjA9', 's59MctoL3Y', 'eX3Ms2LXtK', 'wdGMCqskIY', 'DZ9MGiO2q0', 'SNyMld59l9', 'y26MBpHZ8L', 'ir7MdcIk8M', 'ibxM83jKad', 'gdRMwAQ0vX'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, anZIZUvahbo8m36Em5.cs High entropy of concatenated method names: 'I5XMP1Mt0R', 'aqnMtFTEHX', 'Yn0MpUCHWB', 'PwoMULpEGs', 'vLjMJZ3iti', 'gI4M4NLwLT', 'EomMQcOZa8', 'KEf9b02Hj9', 'tho9yV8a0f', 'zAI9ApuiqF'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, etTXdp1X8V6NlmkcnO.cs High entropy of concatenated method names: 'MWgQ67C9vj', 'b3mQJBrWd2', 'SQwQ4AsUjV', 'RbcQq1NZjG', 'TXeQmfvA2r', 'EuT4gjypA5', 'ni5457DWhu', 'v4q4b81Z92', 'VWk4yKRhQE', 'q3a4A7yXsC'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, d0SNm99VcgUf1Y29Ws.cs High entropy of concatenated method names: 'qmEqUiXd4l', 'HbZqKV4jTV', 'KqEqQ1ZTu9', 'bXKQukgAlx', 'mH7QzOXNTR', 'ni1qIpBvC2', 'WjZqPht2F3', 'Obfq1P2BXE', 'exkqtAfBHa', 'VOEqp7AprD'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, At0mNj5JCKLWRZ41td.cs High entropy of concatenated method names: 'vDjsr003a', 'nSaCr9I5Q', 'JlplCRtNB', 'arZBIZrLs', 'l018DRUpr', 'NEKwI0gvM', 'Sonc55VhgqkQVVgTMr', 'HKK3i3cBJPegqXZXUZ', 'RbK9P9y2P', 'AWjX4b40f'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, jbhJFoOtPd8SynLbCU.cs High entropy of concatenated method names: 'Dispose', 'e5dPAZTLVe', 'BMk1NtZNby', 'zV8LLPPKOt', 'm8YPuQfw5H', 'aQPPzLtfxJ', 'ProcessDialogKey', 'KR81IGvkHI', 'd031P4kvfh', 'rLO11tRpNo'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, YbprunAdej833j571V.cs High entropy of concatenated method names: 'u0LeyfZddb', 'iBNeuy1jNO', 'AOR9I471pR', 'CNr9PelUoh', 'dhAexbkIQ5', 'wfDe0uIM9q', 'P8eeiIsNOr', 'vlHeY7evwv', 'S8CejaB8Md', 'lCfevTyfWV'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, TaAiifNZxnIK0gKrV6.cs High entropy of concatenated method names: 'iiy3dliiv3', 'z7I381E1MN', 'eDi3FsUVeS', 'fy53NlkULf', 'crp37wxRpe', 'AGG3ZYqhfD', 'hLO3HKr5MN', 'fAu3EGgl1Z', 'zEf3DUhYIT', 'YrM3x6589C'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, gxuNj4iueV3QrTrwc7.cs High entropy of concatenated method names: 'nuVqfC9qBY', 'jMKqcagHE9', 'r1rqsK1bWw', 'cfdqCe3GGR', 'we9qGkoP27', 'cOwqliNJRb', 'NFMqBUduCJ', 'A2OqdP59SM', 'wHvq8x09FC', 'a4jqwS0Dd8'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, o0MTSKKweWEVQKjro4x.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'RXFXYqT9X4', 'yohXjeKVpj', 'H3oXvMkFhB', 'f9HXre0vSF', 'zynXgrAwnT', 'eW7X5cRf3c', 'kurXb830FI'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, XSuGiCFPwpINIaNj1i.cs High entropy of concatenated method names: 'j65eoI5AVF', 'X0neTi7HIo', 'ToString', 'XwEeUlJX41', 'IfWeJIZVJ1', 'm33eKoJ5aC', 'cFDe4Nx5o9', 'qMIeQl3jWk', 'Ou6eqBfmOf', 'IxMemcGvFw'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, q1yRBkpS3y5kP3hRGO.cs High entropy of concatenated method names: 'VGrJYOUsmF', 'nPSJjo5to2', 'Va1JvRIhoF', 'graJrHeeUl', 'z4cJgL2Hnr', 'gFMJ5pVLjf', 'BP0JbcqOG4', 'nFJJysCZfD', 'pH5JA8U67F', 'JYlJu0vx9g'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, y6PHtoxs9c243ifuiW.cs High entropy of concatenated method names: 'uXXt6LmmkP', 'vE1tUryNm2', 'TLEtJBZr9E', 'uLatKsAAuL', 'noct4NpLX2', 'MNstQVnoiE', 'RfetqMQ5xD', 'BEdtmjIjSX', 'agHtVOGk8D', 'pDMtohGfN0'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, owmcQrfhm38luXPsgX.cs High entropy of concatenated method names: 'z5sRDcTJLV', 'AMTR04YJ70', 'boDRYlNnEw', 'mAPRjOdGsD', 'oNZRN8QFHh', 'fkmRabgVhy', 'zQnR7HTu2v', 'SyyRZQBZdq', 'vaoRSmO72p', 'FXDRHkLSx0'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, DXq8YSG6iTZgiJi4YW.cs High entropy of concatenated method names: 'p8t9FHaZhP', 'MRI9NnEZYq', 'LNd9atNRxZ', 'G1J97VEQ7w', 'BRY9YOTkfj', 'SrC9Zx6s5a', 'Next', 'Next', 'Next', 'NextBytes'
Source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, F5G4HpzwED2Rs1Ytvi.cs High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'ubFM3qbRRF', 'koJMRrkr7S', 'rWyM2SfbBv', 'f9hMeobkju', 'VU9M9NdJZP', 'wraMMrYgvV', 'eIyMXdiD9j'
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040A068 memset,memset,RegOpenKeyExW,RegQueryValueExW,lstrcmpiW,LoadStringW,MessageBoxW,RegCloseKey,GetPrivateProfileIntW,GetPrivateProfileIntW,LoadStringW,LoadStringW,LoadStringW,MessageBoxW,GetSystemDirectoryW, 9_2_0040A068
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040A47F RegOpenKeyExW,RegQueryValueExW,GetPrivateProfileIntW,RegQueryValueExW,RegQueryValueExW,RegCloseKey, 9_2_0040A47F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040DD1E memset,memset,memset,memset,LoadStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,RegCreateKeyExW,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,RegCloseKey,lstrlenW,memset,lstrlenW,lstrlenW,RegSetValueExW,lstrlenW,lstrlenW,lstrlenW,lstrlenW,CmMalloc,CreateFileW,CloseHandle,CmFree,CmFree,GetPrivateProfileIntW,SetFileAttributesW,SHFileOperationW,RegCloseKey,RegCloseKey, 9_2_0040DD1E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040D233 RegOpenKeyExW,GetPrivateProfileIntW,GetSystemDirectoryW,memset,GetPrivateProfileStringW,RegOpenKeyExW,RegCloseKey,RegOpenKeyExW,RegCloseKey,memset,RegEnumValueW,RegCloseKey, 9_2_0040D233
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040B634 LoadStringW,GetPrivateProfileStringW,GetPrivateProfileStringW,GetPrivateProfileIntW,LoadStringW,MessageBoxW,CmFree,CmFree,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,LoadStringW,MessageBoxW,memset,memset,memset,RegOpenKeyExW,RegQueryValueExW,ExpandEnvironmentStringsW,lstrcmpiW,LoadStringW,MessageBoxW,RegCloseKey,LoadStringW,RegCreateKeyW,lstrlenW,RegSetValueExW,LoadStringW,MessageBoxW,RegCloseKey,RegCloseKey,memset,memset,CopyFileW,LoadStringW,MessageBoxW,GetOSVersion,GetOSMajorVersion,CmMalloc,memset,CmFree,CmMalloc,memset,GetLastError,CmFree,lstrlenW,CmMalloc,lstrlenW,CmFree,CmFree,RegOpenKeyExW,RegDeleteValueW,RegCloseKey,LoadStringW,MessageBoxExW,CmMalloc,memset,CmFree,CmMalloc, 9_2_0040B634
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_00405DEC memset,GetPrivateProfileStringW,GetModuleHandleA,GetProcAddress,GetCurrentProcess,RegOpenKeyExW,RegQueryValueExW,RegCloseKey,GetProcAddress,GetProcAddress,FreeLibrary, 9_2_00405DEC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040A6EE GetPrivateProfileIntW,GetPrivateProfileIntW,GetPrivateProfileIntW,LoadStringW,LoadStringW,lstrlenW,lstrlenW,lstrlenW,LoadStringW,LoadStringW,MessageBoxW,LoadStringW,GetSystemDirectoryW,LoadStringW,MessageBoxW, 9_2_0040A6EE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040CAB4 GetSystemDirectoryW,memset,GetPrivateProfileStringW,RegOpenKeyExW,RegDeleteValueW,RegDeleteValueW,RegCloseKey,CmFree, 9_2_0040CAB4

Hooking and other Techniques for Hiding and Protection
barindex
Loading BitLocker PowerShell Module
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\BitLocker.psd1 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File opened: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\en-US\BitLocker.psd1 Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Yara detected AntiVM3
Source: Yara match File source: Process Memory Space: tnbws7pyQvMUSjF.exe PID: 7664, type: MEMORYSTR
Switches to a custom stack to bypass stack traces
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe API/Special instruction interceptor: Address: 7FFBCB7AD324
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe API/Special instruction interceptor: Address: 7FFBCB7B0774
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe API/Special instruction interceptor: Address: 7FFBCB7B0154
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe API/Special instruction interceptor: Address: 7FFBCB7AD8A4
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe API/Special instruction interceptor: Address: 7FFBCB7ADA44
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe API/Special instruction interceptor: Address: 7FFBCB7AD1E4
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7AD324
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7B0774
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7AD944
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7AD504
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7AD544
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7AD1E4
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7B0154
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7AD8A4
Source: C:\Windows\SysWOW64\cmstp.exe API/Special instruction interceptor: Address: 7FFBCB7ADA44
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe RDTSC instruction interceptor: First address: 409904 second address: 40990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe RDTSC instruction interceptor: First address: 409B7E second address: 409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 2CF9904 second address: 2CF990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 2CF9B7E second address: 2CF9B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Allocates memory with a write watch (potentially for evading sandboxes)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: 1310000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: 2FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: 4FC0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: 7F10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: 8F10000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: 90C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: A0C0000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: A420000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: B420000 memory reserve | memory write watch Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: C420000 memory reserve | memory write watch Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_00409AB0 rdtsc 6_2_00409AB0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 5848 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 3778 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 2304 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: threadDelayed 7621 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 879 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Window / User API: threadDelayed 9753 Jump to behavior
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe API coverage: 1.8 %
Source: C:\Windows\SysWOW64\cmstp.exe API coverage: 1.6 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe TID: 7692 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 8024 Thread sleep time: -7378697629483816s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 5948 Thread sleep count: 2304 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 5948 Thread sleep time: -4608000s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 5948 Thread sleep count: 7621 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 5948 Thread sleep time: -15242000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 7476 Thread sleep count: 220 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 7476 Thread sleep time: -440000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 7476 Thread sleep count: 9753 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 7476 Thread sleep time: -19506000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040894B memset,memset,memset,SHGetFolderPathW,memset,SHGetFolderPathW,CmFree,memset,FindFirstFileW,GetLastError,memset,memset,FindNextFileW,FindClose, 9_2_0040894B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040B3C4 memset,GetPrivateProfileStringW,FindFirstFileW,memset,FindNextFileW, 9_2_0040B3C4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040F80E GetSystemInfo,GetVersionExW, 9_2_0040F80E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000007.00000002.3854031180.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000090DA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAWystem32\DriverStore\en\volume.inf_loc
Source: explorer.exe, 00000007.00000000.1408552220.0000000000A20000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\4&1656f219&0&000000
Source: explorer.exe, 00000007.00000003.2286137779.000000000928D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: NXTcaVMWare
Source: explorer.exe, 00000007.00000003.2285772758.0000000009330000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}F
Source: explorer.exe, 00000007.00000000.1408552220.0000000000A20000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00=
Source: explorer.exe, 00000007.00000000.1421559530.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3854658121.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.0000000009255000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.3076935292.0000000009255000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000007.00000000.1421559530.00000000091FB000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\4&224f42ef&0&000000
Source: explorer.exe, 00000007.00000002.3854031180.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.00000000090DA000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000003.2284429922.00000000090DA000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000007.00000000.1408552220.0000000000A20000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: SCSI\DISK&VEN_VMWARE&PROD_VIRTUAL_DISK\4&1656F219&0&000000
Source: explorer.exe, 00000007.00000003.2285772758.0000000009330000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#4&224f42ef&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000003.2286137779.000000000928D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\4&224F42EF&0&000000
Source: explorer.exe, 00000007.00000000.1408552220.0000000000A20000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_00409AB0 rdtsc 6_2_00409AB0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0040ACF0 LdrLoadDll, 6_2_0040ACF0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A0124 mov eax, dword ptr fs:[00000030h] 6_2_012A0124
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01330115 mov eax, dword ptr fs:[00000030h] 6_2_01330115
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131A118 mov ecx, dword ptr fs:[00000030h] 6_2_0131A118
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131A118 mov eax, dword ptr fs:[00000030h] 6_2_0131A118
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131A118 mov eax, dword ptr fs:[00000030h] 6_2_0131A118
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131A118 mov eax, dword ptr fs:[00000030h] 6_2_0131A118
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01308158 mov eax, dword ptr fs:[00000030h] 6_2_01308158
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126C156 mov eax, dword ptr fs:[00000030h] 6_2_0126C156
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276154 mov eax, dword ptr fs:[00000030h] 6_2_01276154
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276154 mov eax, dword ptr fs:[00000030h] 6_2_01276154
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01304144 mov eax, dword ptr fs:[00000030h] 6_2_01304144
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01304144 mov eax, dword ptr fs:[00000030h] 6_2_01304144
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01304144 mov ecx, dword ptr fs:[00000030h] 6_2_01304144
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01304144 mov eax, dword ptr fs:[00000030h] 6_2_01304144
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01304144 mov eax, dword ptr fs:[00000030h] 6_2_01304144
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B0185 mov eax, dword ptr fs:[00000030h] 6_2_012B0185
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F019F mov eax, dword ptr fs:[00000030h] 6_2_012F019F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F019F mov eax, dword ptr fs:[00000030h] 6_2_012F019F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F019F mov eax, dword ptr fs:[00000030h] 6_2_012F019F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F019F mov eax, dword ptr fs:[00000030h] 6_2_012F019F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126A197 mov eax, dword ptr fs:[00000030h] 6_2_0126A197
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126A197 mov eax, dword ptr fs:[00000030h] 6_2_0126A197
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126A197 mov eax, dword ptr fs:[00000030h] 6_2_0126A197
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0132C188 mov eax, dword ptr fs:[00000030h] 6_2_0132C188
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0132C188 mov eax, dword ptr fs:[00000030h] 6_2_0132C188
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013461E5 mov eax, dword ptr fs:[00000030h] 6_2_013461E5
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A01F8 mov eax, dword ptr fs:[00000030h] 6_2_012A01F8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013361C3 mov eax, dword ptr fs:[00000030h] 6_2_013361C3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013361C3 mov eax, dword ptr fs:[00000030h] 6_2_013361C3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE1D0 mov eax, dword ptr fs:[00000030h] 6_2_012EE1D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE1D0 mov eax, dword ptr fs:[00000030h] 6_2_012EE1D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE1D0 mov ecx, dword ptr fs:[00000030h] 6_2_012EE1D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE1D0 mov eax, dword ptr fs:[00000030h] 6_2_012EE1D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE1D0 mov eax, dword ptr fs:[00000030h] 6_2_012EE1D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01306030 mov eax, dword ptr fs:[00000030h] 6_2_01306030
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126A020 mov eax, dword ptr fs:[00000030h] 6_2_0126A020
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126C020 mov eax, dword ptr fs:[00000030h] 6_2_0126C020
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F4000 mov ecx, dword ptr fs:[00000030h] 6_2_012F4000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 mov eax, dword ptr fs:[00000030h] 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 mov eax, dword ptr fs:[00000030h] 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 mov eax, dword ptr fs:[00000030h] 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 mov eax, dword ptr fs:[00000030h] 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 mov eax, dword ptr fs:[00000030h] 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 mov eax, dword ptr fs:[00000030h] 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 mov eax, dword ptr fs:[00000030h] 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01312000 mov eax, dword ptr fs:[00000030h] 6_2_01312000
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E016 mov eax, dword ptr fs:[00000030h] 6_2_0128E016
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E016 mov eax, dword ptr fs:[00000030h] 6_2_0128E016
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E016 mov eax, dword ptr fs:[00000030h] 6_2_0128E016
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E016 mov eax, dword ptr fs:[00000030h] 6_2_0128E016
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129C073 mov eax, dword ptr fs:[00000030h] 6_2_0129C073
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01272050 mov eax, dword ptr fs:[00000030h] 6_2_01272050
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F6050 mov eax, dword ptr fs:[00000030h] 6_2_012F6050
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013360B8 mov eax, dword ptr fs:[00000030h] 6_2_013360B8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013360B8 mov ecx, dword ptr fs:[00000030h] 6_2_013360B8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013080A8 mov eax, dword ptr fs:[00000030h] 6_2_013080A8
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127208A mov eax, dword ptr fs:[00000030h] 6_2_0127208A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126A0E3 mov ecx, dword ptr fs:[00000030h] 6_2_0126A0E3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012780E9 mov eax, dword ptr fs:[00000030h] 6_2_012780E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F60E0 mov eax, dword ptr fs:[00000030h] 6_2_012F60E0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126C0F0 mov eax, dword ptr fs:[00000030h] 6_2_0126C0F0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B20F0 mov ecx, dword ptr fs:[00000030h] 6_2_012B20F0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F20DE mov eax, dword ptr fs:[00000030h] 6_2_012F20DE
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA30B mov eax, dword ptr fs:[00000030h] 6_2_012AA30B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA30B mov eax, dword ptr fs:[00000030h] 6_2_012AA30B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA30B mov eax, dword ptr fs:[00000030h] 6_2_012AA30B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126C310 mov ecx, dword ptr fs:[00000030h] 6_2_0126C310
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01290310 mov ecx, dword ptr fs:[00000030h] 6_2_01290310
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131437C mov eax, dword ptr fs:[00000030h] 6_2_0131437C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133A352 mov eax, dword ptr fs:[00000030h] 6_2_0133A352
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F2349 mov eax, dword ptr fs:[00000030h] 6_2_012F2349
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F035C mov eax, dword ptr fs:[00000030h] 6_2_012F035C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F035C mov eax, dword ptr fs:[00000030h] 6_2_012F035C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F035C mov eax, dword ptr fs:[00000030h] 6_2_012F035C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F035C mov ecx, dword ptr fs:[00000030h] 6_2_012F035C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F035C mov eax, dword ptr fs:[00000030h] 6_2_012F035C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F035C mov eax, dword ptr fs:[00000030h] 6_2_012F035C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129438F mov eax, dword ptr fs:[00000030h] 6_2_0129438F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129438F mov eax, dword ptr fs:[00000030h] 6_2_0129438F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126E388 mov eax, dword ptr fs:[00000030h] 6_2_0126E388
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126E388 mov eax, dword ptr fs:[00000030h] 6_2_0126E388
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126E388 mov eax, dword ptr fs:[00000030h] 6_2_0126E388
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01268397 mov eax, dword ptr fs:[00000030h] 6_2_01268397
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01268397 mov eax, dword ptr fs:[00000030h] 6_2_01268397
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01268397 mov eax, dword ptr fs:[00000030h] 6_2_01268397
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012803E9 mov eax, dword ptr fs:[00000030h] 6_2_012803E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012803E9 mov eax, dword ptr fs:[00000030h] 6_2_012803E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012803E9 mov eax, dword ptr fs:[00000030h] 6_2_012803E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012803E9 mov eax, dword ptr fs:[00000030h] 6_2_012803E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012803E9 mov eax, dword ptr fs:[00000030h] 6_2_012803E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012803E9 mov eax, dword ptr fs:[00000030h] 6_2_012803E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012803E9 mov eax, dword ptr fs:[00000030h] 6_2_012803E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012803E9 mov eax, dword ptr fs:[00000030h] 6_2_012803E9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A63FF mov eax, dword ptr fs:[00000030h] 6_2_012A63FF
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E3F0 mov eax, dword ptr fs:[00000030h] 6_2_0128E3F0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E3F0 mov eax, dword ptr fs:[00000030h] 6_2_0128E3F0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E3F0 mov eax, dword ptr fs:[00000030h] 6_2_0128E3F0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013143D4 mov eax, dword ptr fs:[00000030h] 6_2_013143D4
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013143D4 mov eax, dword ptr fs:[00000030h] 6_2_013143D4
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0127A3C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0127A3C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0127A3C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0127A3C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0127A3C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A3C0 mov eax, dword ptr fs:[00000030h] 6_2_0127A3C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012783C0 mov eax, dword ptr fs:[00000030h] 6_2_012783C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012783C0 mov eax, dword ptr fs:[00000030h] 6_2_012783C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012783C0 mov eax, dword ptr fs:[00000030h] 6_2_012783C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012783C0 mov eax, dword ptr fs:[00000030h] 6_2_012783C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F63C0 mov eax, dword ptr fs:[00000030h] 6_2_012F63C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0132C3CD mov eax, dword ptr fs:[00000030h] 6_2_0132C3CD
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126823B mov eax, dword ptr fs:[00000030h] 6_2_0126823B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01320274 mov eax, dword ptr fs:[00000030h] 6_2_01320274
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01274260 mov eax, dword ptr fs:[00000030h] 6_2_01274260
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01274260 mov eax, dword ptr fs:[00000030h] 6_2_01274260
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01274260 mov eax, dword ptr fs:[00000030h] 6_2_01274260
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126826B mov eax, dword ptr fs:[00000030h] 6_2_0126826B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F8243 mov eax, dword ptr fs:[00000030h] 6_2_012F8243
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F8243 mov ecx, dword ptr fs:[00000030h] 6_2_012F8243
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126A250 mov eax, dword ptr fs:[00000030h] 6_2_0126A250
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276259 mov eax, dword ptr fs:[00000030h] 6_2_01276259
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012802A0 mov eax, dword ptr fs:[00000030h] 6_2_012802A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012802A0 mov eax, dword ptr fs:[00000030h] 6_2_012802A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013062A0 mov eax, dword ptr fs:[00000030h] 6_2_013062A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013062A0 mov ecx, dword ptr fs:[00000030h] 6_2_013062A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013062A0 mov eax, dword ptr fs:[00000030h] 6_2_013062A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013062A0 mov eax, dword ptr fs:[00000030h] 6_2_013062A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013062A0 mov eax, dword ptr fs:[00000030h] 6_2_013062A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013062A0 mov eax, dword ptr fs:[00000030h] 6_2_013062A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F0283 mov eax, dword ptr fs:[00000030h] 6_2_012F0283
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F0283 mov eax, dword ptr fs:[00000030h] 6_2_012F0283
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F0283 mov eax, dword ptr fs:[00000030h] 6_2_012F0283
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE284 mov eax, dword ptr fs:[00000030h] 6_2_012AE284
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE284 mov eax, dword ptr fs:[00000030h] 6_2_012AE284
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012802E1 mov eax, dword ptr fs:[00000030h] 6_2_012802E1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012802E1 mov eax, dword ptr fs:[00000030h] 6_2_012802E1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012802E1 mov eax, dword ptr fs:[00000030h] 6_2_012802E1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0127A2C3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0127A2C3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0127A2C3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0127A2C3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A2C3 mov eax, dword ptr fs:[00000030h] 6_2_0127A2C3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E53E mov eax, dword ptr fs:[00000030h] 6_2_0129E53E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E53E mov eax, dword ptr fs:[00000030h] 6_2_0129E53E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E53E mov eax, dword ptr fs:[00000030h] 6_2_0129E53E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E53E mov eax, dword ptr fs:[00000030h] 6_2_0129E53E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E53E mov eax, dword ptr fs:[00000030h] 6_2_0129E53E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280535 mov eax, dword ptr fs:[00000030h] 6_2_01280535
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280535 mov eax, dword ptr fs:[00000030h] 6_2_01280535
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280535 mov eax, dword ptr fs:[00000030h] 6_2_01280535
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280535 mov eax, dword ptr fs:[00000030h] 6_2_01280535
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280535 mov eax, dword ptr fs:[00000030h] 6_2_01280535
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280535 mov eax, dword ptr fs:[00000030h] 6_2_01280535
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01306500 mov eax, dword ptr fs:[00000030h] 6_2_01306500
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344500 mov eax, dword ptr fs:[00000030h] 6_2_01344500
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344500 mov eax, dword ptr fs:[00000030h] 6_2_01344500
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344500 mov eax, dword ptr fs:[00000030h] 6_2_01344500
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344500 mov eax, dword ptr fs:[00000030h] 6_2_01344500
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344500 mov eax, dword ptr fs:[00000030h] 6_2_01344500
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344500 mov eax, dword ptr fs:[00000030h] 6_2_01344500
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344500 mov eax, dword ptr fs:[00000030h] 6_2_01344500
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A656A mov eax, dword ptr fs:[00000030h] 6_2_012A656A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A656A mov eax, dword ptr fs:[00000030h] 6_2_012A656A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A656A mov eax, dword ptr fs:[00000030h] 6_2_012A656A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278550 mov eax, dword ptr fs:[00000030h] 6_2_01278550
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278550 mov eax, dword ptr fs:[00000030h] 6_2_01278550
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F05A7 mov eax, dword ptr fs:[00000030h] 6_2_012F05A7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F05A7 mov eax, dword ptr fs:[00000030h] 6_2_012F05A7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F05A7 mov eax, dword ptr fs:[00000030h] 6_2_012F05A7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012945B1 mov eax, dword ptr fs:[00000030h] 6_2_012945B1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012945B1 mov eax, dword ptr fs:[00000030h] 6_2_012945B1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A4588 mov eax, dword ptr fs:[00000030h] 6_2_012A4588
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01272582 mov eax, dword ptr fs:[00000030h] 6_2_01272582
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01272582 mov ecx, dword ptr fs:[00000030h] 6_2_01272582
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE59C mov eax, dword ptr fs:[00000030h] 6_2_012AE59C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012725E0 mov eax, dword ptr fs:[00000030h] 6_2_012725E0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AC5ED mov eax, dword ptr fs:[00000030h] 6_2_012AC5ED
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AC5ED mov eax, dword ptr fs:[00000030h] 6_2_012AC5ED
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0129E5E7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0129E5E7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0129E5E7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0129E5E7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0129E5E7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0129E5E7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0129E5E7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E5E7 mov eax, dword ptr fs:[00000030h] 6_2_0129E5E7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE5CF mov eax, dword ptr fs:[00000030h] 6_2_012AE5CF
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE5CF mov eax, dword ptr fs:[00000030h] 6_2_012AE5CF
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012765D0 mov eax, dword ptr fs:[00000030h] 6_2_012765D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA5D0 mov eax, dword ptr fs:[00000030h] 6_2_012AA5D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA5D0 mov eax, dword ptr fs:[00000030h] 6_2_012AA5D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126C427 mov eax, dword ptr fs:[00000030h] 6_2_0126C427
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126E420 mov eax, dword ptr fs:[00000030h] 6_2_0126E420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126E420 mov eax, dword ptr fs:[00000030h] 6_2_0126E420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126E420 mov eax, dword ptr fs:[00000030h] 6_2_0126E420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F6420 mov eax, dword ptr fs:[00000030h] 6_2_012F6420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F6420 mov eax, dword ptr fs:[00000030h] 6_2_012F6420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F6420 mov eax, dword ptr fs:[00000030h] 6_2_012F6420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F6420 mov eax, dword ptr fs:[00000030h] 6_2_012F6420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F6420 mov eax, dword ptr fs:[00000030h] 6_2_012F6420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F6420 mov eax, dword ptr fs:[00000030h] 6_2_012F6420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F6420 mov eax, dword ptr fs:[00000030h] 6_2_012F6420
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA430 mov eax, dword ptr fs:[00000030h] 6_2_012AA430
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A8402 mov eax, dword ptr fs:[00000030h] 6_2_012A8402
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A8402 mov eax, dword ptr fs:[00000030h] 6_2_012A8402
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A8402 mov eax, dword ptr fs:[00000030h] 6_2_012A8402
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FC460 mov ecx, dword ptr fs:[00000030h] 6_2_012FC460
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129A470 mov eax, dword ptr fs:[00000030h] 6_2_0129A470
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129A470 mov eax, dword ptr fs:[00000030h] 6_2_0129A470
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129A470 mov eax, dword ptr fs:[00000030h] 6_2_0129A470
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE443 mov eax, dword ptr fs:[00000030h] 6_2_012AE443
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE443 mov eax, dword ptr fs:[00000030h] 6_2_012AE443
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE443 mov eax, dword ptr fs:[00000030h] 6_2_012AE443
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE443 mov eax, dword ptr fs:[00000030h] 6_2_012AE443
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE443 mov eax, dword ptr fs:[00000030h] 6_2_012AE443
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE443 mov eax, dword ptr fs:[00000030h] 6_2_012AE443
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE443 mov eax, dword ptr fs:[00000030h] 6_2_012AE443
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AE443 mov eax, dword ptr fs:[00000030h] 6_2_012AE443
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129245A mov eax, dword ptr fs:[00000030h] 6_2_0129245A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126645D mov eax, dword ptr fs:[00000030h] 6_2_0126645D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012764AB mov eax, dword ptr fs:[00000030h] 6_2_012764AB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A44B0 mov ecx, dword ptr fs:[00000030h] 6_2_012A44B0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FA4B0 mov eax, dword ptr fs:[00000030h] 6_2_012FA4B0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012704E5 mov ecx, dword ptr fs:[00000030h] 6_2_012704E5
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AC720 mov eax, dword ptr fs:[00000030h] 6_2_012AC720
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AC720 mov eax, dword ptr fs:[00000030h] 6_2_012AC720
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A273C mov eax, dword ptr fs:[00000030h] 6_2_012A273C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A273C mov ecx, dword ptr fs:[00000030h] 6_2_012A273C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A273C mov eax, dword ptr fs:[00000030h] 6_2_012A273C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EC730 mov eax, dword ptr fs:[00000030h] 6_2_012EC730
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AC700 mov eax, dword ptr fs:[00000030h] 6_2_012AC700
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270710 mov eax, dword ptr fs:[00000030h] 6_2_01270710
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A0710 mov eax, dword ptr fs:[00000030h] 6_2_012A0710
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278770 mov eax, dword ptr fs:[00000030h] 6_2_01278770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280770 mov eax, dword ptr fs:[00000030h] 6_2_01280770
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A674D mov esi, dword ptr fs:[00000030h] 6_2_012A674D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A674D mov eax, dword ptr fs:[00000030h] 6_2_012A674D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A674D mov eax, dword ptr fs:[00000030h] 6_2_012A674D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FE75D mov eax, dword ptr fs:[00000030h] 6_2_012FE75D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270750 mov eax, dword ptr fs:[00000030h] 6_2_01270750
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F4755 mov eax, dword ptr fs:[00000030h] 6_2_012F4755
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2750 mov eax, dword ptr fs:[00000030h] 6_2_012B2750
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2750 mov eax, dword ptr fs:[00000030h] 6_2_012B2750
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012707AF mov eax, dword ptr fs:[00000030h] 6_2_012707AF
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131678E mov eax, dword ptr fs:[00000030h] 6_2_0131678E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012927ED mov eax, dword ptr fs:[00000030h] 6_2_012927ED
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012927ED mov eax, dword ptr fs:[00000030h] 6_2_012927ED
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012927ED mov eax, dword ptr fs:[00000030h] 6_2_012927ED
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FE7E1 mov eax, dword ptr fs:[00000030h] 6_2_012FE7E1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012747FB mov eax, dword ptr fs:[00000030h] 6_2_012747FB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012747FB mov eax, dword ptr fs:[00000030h] 6_2_012747FB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127C7C0 mov eax, dword ptr fs:[00000030h] 6_2_0127C7C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F07C3 mov eax, dword ptr fs:[00000030h] 6_2_012F07C3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A6620 mov eax, dword ptr fs:[00000030h] 6_2_012A6620
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A8620 mov eax, dword ptr fs:[00000030h] 6_2_012A8620
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127262C mov eax, dword ptr fs:[00000030h] 6_2_0127262C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128E627 mov eax, dword ptr fs:[00000030h] 6_2_0128E627
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128260B mov eax, dword ptr fs:[00000030h] 6_2_0128260B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128260B mov eax, dword ptr fs:[00000030h] 6_2_0128260B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128260B mov eax, dword ptr fs:[00000030h] 6_2_0128260B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128260B mov eax, dword ptr fs:[00000030h] 6_2_0128260B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128260B mov eax, dword ptr fs:[00000030h] 6_2_0128260B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128260B mov eax, dword ptr fs:[00000030h] 6_2_0128260B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128260B mov eax, dword ptr fs:[00000030h] 6_2_0128260B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE609 mov eax, dword ptr fs:[00000030h] 6_2_012EE609
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B2619 mov eax, dword ptr fs:[00000030h] 6_2_012B2619
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA660 mov eax, dword ptr fs:[00000030h] 6_2_012AA660
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA660 mov eax, dword ptr fs:[00000030h] 6_2_012AA660
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133866E mov eax, dword ptr fs:[00000030h] 6_2_0133866E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133866E mov eax, dword ptr fs:[00000030h] 6_2_0133866E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A2674 mov eax, dword ptr fs:[00000030h] 6_2_012A2674
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128C640 mov eax, dword ptr fs:[00000030h] 6_2_0128C640
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AC6A6 mov eax, dword ptr fs:[00000030h] 6_2_012AC6A6
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A66B0 mov eax, dword ptr fs:[00000030h] 6_2_012A66B0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01274690 mov eax, dword ptr fs:[00000030h] 6_2_01274690
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01274690 mov eax, dword ptr fs:[00000030h] 6_2_01274690
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE6F2 mov eax, dword ptr fs:[00000030h] 6_2_012EE6F2
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE6F2 mov eax, dword ptr fs:[00000030h] 6_2_012EE6F2
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE6F2 mov eax, dword ptr fs:[00000030h] 6_2_012EE6F2
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE6F2 mov eax, dword ptr fs:[00000030h] 6_2_012EE6F2
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F06F1 mov eax, dword ptr fs:[00000030h] 6_2_012F06F1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F06F1 mov eax, dword ptr fs:[00000030h] 6_2_012F06F1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA6C7 mov ebx, dword ptr fs:[00000030h] 6_2_012AA6C7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA6C7 mov eax, dword ptr fs:[00000030h] 6_2_012AA6C7
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F892A mov eax, dword ptr fs:[00000030h] 6_2_012F892A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0130892B mov eax, dword ptr fs:[00000030h] 6_2_0130892B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE908 mov eax, dword ptr fs:[00000030h] 6_2_012EE908
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EE908 mov eax, dword ptr fs:[00000030h] 6_2_012EE908
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FC912 mov eax, dword ptr fs:[00000030h] 6_2_012FC912
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01268918 mov eax, dword ptr fs:[00000030h] 6_2_01268918
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01268918 mov eax, dword ptr fs:[00000030h] 6_2_01268918
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B096E mov eax, dword ptr fs:[00000030h] 6_2_012B096E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B096E mov edx, dword ptr fs:[00000030h] 6_2_012B096E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012B096E mov eax, dword ptr fs:[00000030h] 6_2_012B096E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01314978 mov eax, dword ptr fs:[00000030h] 6_2_01314978
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01314978 mov eax, dword ptr fs:[00000030h] 6_2_01314978
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01296962 mov eax, dword ptr fs:[00000030h] 6_2_01296962
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01296962 mov eax, dword ptr fs:[00000030h] 6_2_01296962
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01296962 mov eax, dword ptr fs:[00000030h] 6_2_01296962
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FC97C mov eax, dword ptr fs:[00000030h] 6_2_012FC97C
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F0946 mov eax, dword ptr fs:[00000030h] 6_2_012F0946
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012829A0 mov eax, dword ptr fs:[00000030h] 6_2_012829A0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012709AD mov eax, dword ptr fs:[00000030h] 6_2_012709AD
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012709AD mov eax, dword ptr fs:[00000030h] 6_2_012709AD
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F89B3 mov esi, dword ptr fs:[00000030h] 6_2_012F89B3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F89B3 mov eax, dword ptr fs:[00000030h] 6_2_012F89B3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F89B3 mov eax, dword ptr fs:[00000030h] 6_2_012F89B3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FE9E0 mov eax, dword ptr fs:[00000030h] 6_2_012FE9E0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A29F9 mov eax, dword ptr fs:[00000030h] 6_2_012A29F9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A29F9 mov eax, dword ptr fs:[00000030h] 6_2_012A29F9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133A9D3 mov eax, dword ptr fs:[00000030h] 6_2_0133A9D3
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_013069C0 mov eax, dword ptr fs:[00000030h] 6_2_013069C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0127A9D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0127A9D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0127A9D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0127A9D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0127A9D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127A9D0 mov eax, dword ptr fs:[00000030h] 6_2_0127A9D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A49D0 mov eax, dword ptr fs:[00000030h] 6_2_012A49D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131483A mov eax, dword ptr fs:[00000030h] 6_2_0131483A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131483A mov eax, dword ptr fs:[00000030h] 6_2_0131483A
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AA830 mov eax, dword ptr fs:[00000030h] 6_2_012AA830
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01292835 mov eax, dword ptr fs:[00000030h] 6_2_01292835
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01292835 mov eax, dword ptr fs:[00000030h] 6_2_01292835
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01292835 mov eax, dword ptr fs:[00000030h] 6_2_01292835
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01292835 mov ecx, dword ptr fs:[00000030h] 6_2_01292835
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01292835 mov eax, dword ptr fs:[00000030h] 6_2_01292835
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01292835 mov eax, dword ptr fs:[00000030h] 6_2_01292835
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FC810 mov eax, dword ptr fs:[00000030h] 6_2_012FC810
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01306870 mov eax, dword ptr fs:[00000030h] 6_2_01306870
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01306870 mov eax, dword ptr fs:[00000030h] 6_2_01306870
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FE872 mov eax, dword ptr fs:[00000030h] 6_2_012FE872
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FE872 mov eax, dword ptr fs:[00000030h] 6_2_012FE872
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01282840 mov ecx, dword ptr fs:[00000030h] 6_2_01282840
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01274859 mov eax, dword ptr fs:[00000030h] 6_2_01274859
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01274859 mov eax, dword ptr fs:[00000030h] 6_2_01274859
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A0854 mov eax, dword ptr fs:[00000030h] 6_2_012A0854
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270887 mov eax, dword ptr fs:[00000030h] 6_2_01270887
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FC89D mov eax, dword ptr fs:[00000030h] 6_2_012FC89D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AC8F9 mov eax, dword ptr fs:[00000030h] 6_2_012AC8F9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AC8F9 mov eax, dword ptr fs:[00000030h] 6_2_012AC8F9
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133A8E4 mov eax, dword ptr fs:[00000030h] 6_2_0133A8E4
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129E8C0 mov eax, dword ptr fs:[00000030h] 6_2_0129E8C0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129EB20 mov eax, dword ptr fs:[00000030h] 6_2_0129EB20
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129EB20 mov eax, dword ptr fs:[00000030h] 6_2_0129EB20
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01338B28 mov eax, dword ptr fs:[00000030h] 6_2_01338B28
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01338B28 mov eax, dword ptr fs:[00000030h] 6_2_01338B28
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012EEB1D mov eax, dword ptr fs:[00000030h] 6_2_012EEB1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0126CB7E mov eax, dword ptr fs:[00000030h] 6_2_0126CB7E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01306B40 mov eax, dword ptr fs:[00000030h] 6_2_01306B40
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01306B40 mov eax, dword ptr fs:[00000030h] 6_2_01306B40
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0133AB40 mov eax, dword ptr fs:[00000030h] 6_2_0133AB40
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01318B42 mov eax, dword ptr fs:[00000030h] 6_2_01318B42
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280BBE mov eax, dword ptr fs:[00000030h] 6_2_01280BBE
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280BBE mov eax, dword ptr fs:[00000030h] 6_2_01280BBE
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129EBFC mov eax, dword ptr fs:[00000030h] 6_2_0129EBFC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278BF0 mov eax, dword ptr fs:[00000030h] 6_2_01278BF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278BF0 mov eax, dword ptr fs:[00000030h] 6_2_01278BF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278BF0 mov eax, dword ptr fs:[00000030h] 6_2_01278BF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FCBF0 mov eax, dword ptr fs:[00000030h] 6_2_012FCBF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0131EBD0 mov eax, dword ptr fs:[00000030h] 6_2_0131EBD0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01290BCB mov eax, dword ptr fs:[00000030h] 6_2_01290BCB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01290BCB mov eax, dword ptr fs:[00000030h] 6_2_01290BCB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01290BCB mov eax, dword ptr fs:[00000030h] 6_2_01290BCB
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270BCD mov eax, dword ptr fs:[00000030h] 6_2_01270BCD
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270BCD mov eax, dword ptr fs:[00000030h] 6_2_01270BCD
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270BCD mov eax, dword ptr fs:[00000030h] 6_2_01270BCD
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0129EA2E mov eax, dword ptr fs:[00000030h] 6_2_0129EA2E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ACA24 mov eax, dword ptr fs:[00000030h] 6_2_012ACA24
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ACA38 mov eax, dword ptr fs:[00000030h] 6_2_012ACA38
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01294A35 mov eax, dword ptr fs:[00000030h] 6_2_01294A35
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01294A35 mov eax, dword ptr fs:[00000030h] 6_2_01294A35
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012FCA11 mov eax, dword ptr fs:[00000030h] 6_2_012FCA11
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ACA6F mov eax, dword ptr fs:[00000030h] 6_2_012ACA6F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ACA6F mov eax, dword ptr fs:[00000030h] 6_2_012ACA6F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ACA6F mov eax, dword ptr fs:[00000030h] 6_2_012ACA6F
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ECA72 mov eax, dword ptr fs:[00000030h] 6_2_012ECA72
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ECA72 mov eax, dword ptr fs:[00000030h] 6_2_012ECA72
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280A5B mov eax, dword ptr fs:[00000030h] 6_2_01280A5B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01280A5B mov eax, dword ptr fs:[00000030h] 6_2_01280A5B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276A50 mov eax, dword ptr fs:[00000030h] 6_2_01276A50
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276A50 mov eax, dword ptr fs:[00000030h] 6_2_01276A50
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276A50 mov eax, dword ptr fs:[00000030h] 6_2_01276A50
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276A50 mov eax, dword ptr fs:[00000030h] 6_2_01276A50
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276A50 mov eax, dword ptr fs:[00000030h] 6_2_01276A50
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276A50 mov eax, dword ptr fs:[00000030h] 6_2_01276A50
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01276A50 mov eax, dword ptr fs:[00000030h] 6_2_01276A50
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278AA0 mov eax, dword ptr fs:[00000030h] 6_2_01278AA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278AA0 mov eax, dword ptr fs:[00000030h] 6_2_01278AA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012C6AA4 mov eax, dword ptr fs:[00000030h] 6_2_012C6AA4
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127EA80 mov eax, dword ptr fs:[00000030h] 6_2_0127EA80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344A80 mov eax, dword ptr fs:[00000030h] 6_2_01344A80
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A8A90 mov edx, dword ptr fs:[00000030h] 6_2_012A8A90
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AAAEE mov eax, dword ptr fs:[00000030h] 6_2_012AAAEE
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012AAAEE mov eax, dword ptr fs:[00000030h] 6_2_012AAAEE
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012C6ACC mov eax, dword ptr fs:[00000030h] 6_2_012C6ACC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012C6ACC mov eax, dword ptr fs:[00000030h] 6_2_012C6ACC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012C6ACC mov eax, dword ptr fs:[00000030h] 6_2_012C6ACC
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270AD0 mov eax, dword ptr fs:[00000030h] 6_2_01270AD0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A4AD0 mov eax, dword ptr fs:[00000030h] 6_2_012A4AD0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A4AD0 mov eax, dword ptr fs:[00000030h] 6_2_012A4AD0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012F8D20 mov eax, dword ptr fs:[00000030h] 6_2_012F8D20
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01328D10 mov eax, dword ptr fs:[00000030h] 6_2_01328D10
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01328D10 mov eax, dword ptr fs:[00000030h] 6_2_01328D10
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128AD00 mov eax, dword ptr fs:[00000030h] 6_2_0128AD00
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128AD00 mov eax, dword ptr fs:[00000030h] 6_2_0128AD00
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0128AD00 mov eax, dword ptr fs:[00000030h] 6_2_0128AD00
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01266D10 mov eax, dword ptr fs:[00000030h] 6_2_01266D10
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01266D10 mov eax, dword ptr fs:[00000030h] 6_2_01266D10
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01266D10 mov eax, dword ptr fs:[00000030h] 6_2_01266D10
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A4D1D mov eax, dword ptr fs:[00000030h] 6_2_012A4D1D
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01308D6B mov eax, dword ptr fs:[00000030h] 6_2_01308D6B
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270D59 mov eax, dword ptr fs:[00000030h] 6_2_01270D59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270D59 mov eax, dword ptr fs:[00000030h] 6_2_01270D59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01270D59 mov eax, dword ptr fs:[00000030h] 6_2_01270D59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278D59 mov eax, dword ptr fs:[00000030h] 6_2_01278D59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278D59 mov eax, dword ptr fs:[00000030h] 6_2_01278D59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278D59 mov eax, dword ptr fs:[00000030h] 6_2_01278D59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278D59 mov eax, dword ptr fs:[00000030h] 6_2_01278D59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01278D59 mov eax, dword ptr fs:[00000030h] 6_2_01278D59
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012A6DA0 mov eax, dword ptr fs:[00000030h] 6_2_012A6DA0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01298DBF mov eax, dword ptr fs:[00000030h] 6_2_01298DBF
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01298DBF mov eax, dword ptr fs:[00000030h] 6_2_01298DBF
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01344DAD mov eax, dword ptr fs:[00000030h] 6_2_01344DAD
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ACDB1 mov ecx, dword ptr fs:[00000030h] 6_2_012ACDB1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ACDB1 mov eax, dword ptr fs:[00000030h] 6_2_012ACDB1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_012ACDB1 mov eax, dword ptr fs:[00000030h] 6_2_012ACDB1
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01338DAE mov eax, dword ptr fs:[00000030h] 6_2_01338DAE
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01338DAE mov eax, dword ptr fs:[00000030h] 6_2_01338DAE
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01310DF0 mov eax, dword ptr fs:[00000030h] 6_2_01310DF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_01310DF0 mov eax, dword ptr fs:[00000030h] 6_2_01310DF0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127ADE0 mov eax, dword ptr fs:[00000030h] 6_2_0127ADE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127ADE0 mov eax, dword ptr fs:[00000030h] 6_2_0127ADE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127ADE0 mov eax, dword ptr fs:[00000030h] 6_2_0127ADE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127ADE0 mov eax, dword ptr fs:[00000030h] 6_2_0127ADE0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Code function: 6_2_0127ADE0 mov eax, dword ptr fs:[00000030h] 6_2_0127ADE0
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_00410040 WideCharToMultiByte,GetFileVersionInfoSizeA,GetLastError,GetProcessHeap,HeapAlloc,GetFileVersionInfoA,GetLastError,VerQueryValueA,VerQueryValueA,HeapFree, 9_2_00410040
Enables debug privileges
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_00411720 SetUnhandledExceptionFilter, 9_2_00411720
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_004114D0 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 9_2_004114D0
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion
barindex
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe"
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe NtQueueApcThread: Indirect: 0x177A4F2 Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe NtClose: Indirect: 0x177A56C
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Memory written: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section loaded: NULL target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: NULL target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Thread register set: target process: 4084 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Thread register set: target process: 4084 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Section unmapped: C:\Windows\SysWOW64\cmstp.exe base address: 400000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Process created: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe" Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_00408DB2 AllocateAndInitializeSid,GetModuleHandleA,LoadLibraryExA,GetProcAddress,FreeSid,FreeLibrary, 9_2_00408DB2
Source: explorer.exe, 00000007.00000003.2284429922.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1413908531.00000000044D0000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3854765237.000000000936E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000002.3847852434.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1408552220.0000000000A20000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1409861632.0000000001091000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.1409861632.0000000001091000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000002.3848290732.0000000001091000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: 0Program Manager
Source: explorer.exe, 00000007.00000000.1409861632.0000000001091000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000007.00000002.3848290732.0000000001091000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000003.2284429922.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000002.3854765237.000000000936E000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000007.00000000.1421559530.000000000936E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd]1Q
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Queries volume information: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-Package~31bf3856ad364e35~amd64~en-GB~10.0.19041.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package0313~31bf3856ad364e35~amd64~~10.0.19041.1949.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Desktop-Required-WOW64-Package~31bf3856ad364e35~amd64~~10.0.19041.2006.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_00411945 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter, 9_2_00411945
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 9_2_0040F80E GetSystemInfo,GetVersionExW, 9_2_0040F80E
Source: C:\Users\user\Desktop\tnbws7pyQvMUSjF.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.tnbws7pyQvMUSjF.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.tnbws7pyQvMUSjF.exe.4a84220.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.tnbws7pyQvMUSjF.exe.4a14600.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000002.1472437565.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3847658525.0000000002CF0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.1412416832.0000000004842000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3847974925.0000000003070000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.3848322868.0000000004A30000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1527842 Sample: tnbws7pyQvMUSjF.exe Startdate: 07/10/2024 Architecture: WINDOWS Score: 100 37 www.urelook.xyz 2->37 39 www.essislotgoal14.xyz 2->39 41 9 other IPs or domains 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Antivirus / Scanner detection for submitted sample 2->47 51 10 other signatures 2->51 11 tnbws7pyQvMUSjF.exe 4 2->11         started        signatures3 49 Performs DNS queries to domains with low reputation 39->49 process4 file5 35 C:\Users\user\...\tnbws7pyQvMUSjF.exe.log, ASCII 11->35 dropped 53 Adds a directory exclusion to Windows Defender 11->53 55 Tries to detect virtualization through RDTSC time measurements 11->55 57 Injects a PE file into a foreign processes 11->57 59 Switches to a custom stack to bypass stack traces 11->59 15 tnbws7pyQvMUSjF.exe 11->15         started        18 powershell.exe 23 11->18         started        20 tnbws7pyQvMUSjF.exe 11->20         started        signatures6 process7 signatures8 69 Modifies the context of a thread in another process (thread injection) 15->69 71 Maps a DLL or memory area into another process 15->71 73 Sample uses process hollowing technique 15->73 77 2 other signatures 15->77 22 explorer.exe 62 1 15->22 injected 75 Loading BitLocker PowerShell Module 18->75 24 WmiPrvSE.exe 18->24         started        26 conhost.exe 18->26         started        process9 process10 28 cmstp.exe 22->28         started        signatures11 61 Modifies the context of a thread in another process (thread injection) 28->61 63 Maps a DLL or memory area into another process 28->63 65 Tries to detect virtualization through RDTSC time measurements 28->65 67 Switches to a custom stack to bypass stack traces 28->67 31 cmd.exe 1 28->31         started        process12 process13 33 conhost.exe 31->33         started       
⊘No contacted IP infos

Contacted Domains

Name IP Active
www.urelook.xyz unknown unknown
www.essislotgoal14.xyz unknown unknown
www.lecrtort.net unknown unknown
www.ruvabetgiris.website unknown unknown
www.milelab.pro unknown unknown
www.destramentoemcasa.shop unknown unknown
www.aylocnuocionkiem.website unknown unknown
www.gearlpfbm.top unknown unknown
www.6ae23rx.forum unknown unknown
www.xhibitonenotary.info unknown unknown
www.dnusaunni05.sbs unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.xhibitonenotary.info/t18n/ true
    		unknown