Analysis Report 20210113432.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: 20210113432.exe	Virustotal: Detection: 28%			Perma Link
Source: 20210113432.exe	ReversingLabs: Detection: 26%

Yara detected FormBook

Source: Yara match	File source: 00000002.00000002.292282705.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292860797.0000000000FA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292893509.0000000000FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.608235270.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.608474774.0000000000D90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.606729919.0000000000840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.20210113432.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.20210113432.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: 20210113432.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 2.2.20210113432.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: 20210113432.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 20210113432.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: cmstp.pdbGCTL source: 20210113432.exe, 00000002.00000002.292959417.000000000112A000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdbUGP source: 20210113432.exe, 00000002.00000002.293261295.000000000167F000.00000040.00000001.sdmp, cmstp.exe, 0000000A.00000002.610790458.00000000048E0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 20210113432.exe, 00000002.00000002.293261295.000000000167F000.00000040.00000001.sdmp, cmstp.exe
Source:	Binary string: cmstp.pdb source: 20210113432.exe, 00000002.00000002.292959417.000000000112A000.00000004.00000020.sdmp

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\20210113432.exe	Code function: 4x nop then pop edi		2_2_00416C8E
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 4x nop then pop edi		2_2_00417D5A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 4x nop then pop edi		10_2_00856C8E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 4x nop then pop edi		10_2_00857D5A

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49757 -> 74.208.236.28:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49757 -> 74.208.236.28:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.7:49757 -> 74.208.236.28:80

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /dkk/?J49Tz=eln47v8hVLB&EvI=KFec6V/xGjD6cE5qsvd2LTm4Ze1Ufxo42AYbq86iepN500M2vfXbQq6XlD5K+sbe3doaSuc2kQ== HTTP/1.1Host: www.miproper.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dkk/?EvI=VuWlRtEQc0PyYNliE71gHvEq4u/XFVndbD6PF4RlFVBK20m1fz7CdpGmHTE9G7iYyzSgqX7WhA==&J49Tz=eln47v8hVLB HTTP/1.1Host: www.fordexplorerproblems.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dkk/?J49Tz=eln47v8hVLB&EvI=7pEhCqXKdTe1QojMxaT2YAvmPyLKOFb2Iw59nqg2WrUGKA2vL6+QIvazxlaHaXA0UWVS/p1klg== HTTP/1.1Host: www.southsideflooringcreations.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dkk/?J49Tz=eln47v8hVLB&EvI=7pEhCqXKdTe1QojMxaT2YAvmPyLKOFb2Iw59nqg2WrUGKA2vL6+QIvazxlaHaXA0UWVS/p1klg== HTTP/1.1Host: www.southsideflooringcreations.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dkk/?EvI=Pne6zO+Z3a60Au06FHOmVrHS7z/OeLQppxmg+doCWmhHZjdmG5KKLECfP4ZcwEOpNG8I7WvO0Q==&J49Tz=eln47v8hVLB HTTP/1.1Host: www.exoticorganicwine.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 34.102.136.180 34.102.136.180
Source: Joe Sandbox View	IP Address: 184.168.131.241 184.168.131.241

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: GOOGLEUS GOOGLEUS
Source: Joe Sandbox View	ASN Name: AS-26496-GO-DADDY-COM-LLCUS AS-26496-GO-DADDY-COM-LLCUS
Source: Joe Sandbox View	ASN Name: ONEANDONE-ASBrauerstrasse48DE ONEANDONE-ASBrauerstrasse48DE

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /dkk/?J49Tz=eln47v8hVLB&EvI=KFec6V/xGjD6cE5qsvd2LTm4Ze1Ufxo42AYbq86iepN500M2vfXbQq6XlD5K+sbe3doaSuc2kQ== HTTP/1.1Host: www.miproper.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dkk/?EvI=VuWlRtEQc0PyYNliE71gHvEq4u/XFVndbD6PF4RlFVBK20m1fz7CdpGmHTE9G7iYyzSgqX7WhA==&J49Tz=eln47v8hVLB HTTP/1.1Host: www.fordexplorerproblems.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dkk/?J49Tz=eln47v8hVLB&EvI=7pEhCqXKdTe1QojMxaT2YAvmPyLKOFb2Iw59nqg2WrUGKA2vL6+QIvazxlaHaXA0UWVS/p1klg== HTTP/1.1Host: www.southsideflooringcreations.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dkk/?J49Tz=eln47v8hVLB&EvI=7pEhCqXKdTe1QojMxaT2YAvmPyLKOFb2Iw59nqg2WrUGKA2vL6+QIvazxlaHaXA0UWVS/p1klg== HTTP/1.1Host: www.southsideflooringcreations.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /dkk/?EvI=Pne6zO+Z3a60Au06FHOmVrHS7z/OeLQppxmg+doCWmhHZjdmG5KKLECfP4ZcwEOpNG8I7WvO0Q==&J49Tz=eln47v8hVLB HTTP/1.1Host: www.exoticorganicwine.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.semaindustrial.com

Urls found in memory or binary data

Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 20210113432.exe, 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: 20210113432.exe	String found in binary or memory: http://tempuri.org/_391backDataSet.xsd
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000002.623532384.0000000006870000.00000004.00000001.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.278983339.000000000BE76000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000002.00000002.292282705.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292860797.0000000000FA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292893509.0000000000FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.608235270.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.608474774.0000000000D90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.606729919.0000000000840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.20210113432.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.20210113432.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000002.00000002.292282705.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.292282705.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.292860797.0000000000FA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.292860797.0000000000FA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.292893509.0000000000FD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.292893509.0000000000FD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.608235270.0000000000D60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.608235270.0000000000D60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.608474774.0000000000D90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.608474774.0000000000D90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.606729919.0000000000840000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.606729919.0000000000840000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.20210113432.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.20210113432.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.20210113432.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.20210113432.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00419D50 NtCreateFile,		2_2_00419D50
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00419E00 NtReadFile,		2_2_00419E00
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00419E80 NtClose,		2_2_00419E80
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00419F30 NtAllocateVirtualMemory,		2_2_00419F30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949840 NtDelayExecution,LdrInitializeThunk,		10_2_04949840
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949860 NtQuerySystemInformation,LdrInitializeThunk,		10_2_04949860
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049499A0 NtCreateSection,LdrInitializeThunk,		10_2_049499A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049495D0 NtClose,LdrInitializeThunk,		10_2_049495D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949910 NtAdjustPrivilegesToken,LdrInitializeThunk,		10_2_04949910
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949540 NtReadFile,LdrInitializeThunk,		10_2_04949540
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049496D0 NtCreateKey,LdrInitializeThunk,		10_2_049496D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049496E0 NtFreeVirtualMemory,LdrInitializeThunk,		10_2_049496E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949650 NtQueryValueKey,LdrInitializeThunk,		10_2_04949650
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949A50 NtCreateFile,LdrInitializeThunk,		10_2_04949A50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949660 NtAllocateVirtualMemory,LdrInitializeThunk,		10_2_04949660
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949780 NtMapViewOfSection,LdrInitializeThunk,		10_2_04949780
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949FE0 NtCreateMutant,LdrInitializeThunk,		10_2_04949FE0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949710 NtQueryInformationToken,LdrInitializeThunk,		10_2_04949710
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049498A0 NtWriteVirtualMemory,		10_2_049498A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049498F0 NtReadVirtualMemory,		10_2_049498F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949820 NtEnumerateKey,		10_2_04949820
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0494B040 NtSuspendThread,		10_2_0494B040
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049499D0 NtCreateProcessEx,		10_2_049499D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049495F0 NtQueryInformationFile,		10_2_049495F0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0494AD30 NtSetContextThread,		10_2_0494AD30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949520 NtWaitForSingleObject,		10_2_04949520
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949950 NtQueueApcThread,		10_2_04949950
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949560 NtWriteFile,		10_2_04949560
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949A80 NtOpenDirectoryObject,		10_2_04949A80
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949610 NtEnumerateValueKey,		10_2_04949610
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949A10 NtQuerySection,		10_2_04949A10
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949A00 NtProtectVirtualMemory,		10_2_04949A00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949A20 NtResumeThread,		10_2_04949A20
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949670 NtQueryInformationProcess,		10_2_04949670
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0494A3B0 NtGetContextThread,		10_2_0494A3B0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049497A0 NtUnmapViewOfSection,		10_2_049497A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0494A710 NtOpenProcessToken,		10_2_0494A710
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949B00 NtSetValueKey,		10_2_04949B00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949730 NtQueryVirtualMemory,		10_2_04949730
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949770 NtSetInformationFile,		10_2_04949770
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0494A770 NtOpenThread,		10_2_0494A770
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04949760 NtOpenProcess,		10_2_04949760
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00859D50 NtCreateFile,		10_2_00859D50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00859E80 NtClose,		10_2_00859E80
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00859E00 NtReadFile,		10_2_00859E00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00859F30 NtAllocateVirtualMemory,		10_2_00859F30

Detected potential crypto function

Source: C:\Users\user\Desktop\20210113432.exe	Code function: 0_2_009251A1		0_2_009251A1
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 0_2_0093283A		0_2_0093283A
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00401030		2_2_00401030
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041E1EB		2_2_0041E1EB
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041D1F9		2_2_0041D1F9
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041E265		2_2_0041E265
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041D5CF		2_2_0041D5CF
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00402D87		2_2_00402D87
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00402D90		2_2_00402D90
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041E64E		2_2_0041E64E
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00409E30		2_2_00409E30
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041DFF7		2_2_0041DFF7
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00402FB0		2_2_00402FB0
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_009451A1		2_2_009451A1
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0095283A		2_2_0095283A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491B090		10_2_0491B090
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049320A0		10_2_049320A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D20A8		10_2_049D20A8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491841F		10_2_0491841F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1002		10_2_049C1002
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932581		10_2_04932581
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491D5E0		10_2_0491D5E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490F900		10_2_0490F900
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D2D07		10_2_049D2D07
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04900D20		10_2_04900D20
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04924120		10_2_04924120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D1D55		10_2_049D1D55
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D22AE		10_2_049D22AE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D2EF7		10_2_049D2EF7
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04926E30		10_2_04926E30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493EBB0		10_2_0493EBB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CDBD2		10_2_049CDBD2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D1FF1		10_2_049D1FF1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D2B28		10_2_049D2B28
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085E1EB		10_2_0085E1EB
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085E265		10_2_0085E265
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00842D87		10_2_00842D87
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00842D90		10_2_00842D90
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00849E30		10_2_00849E30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085E64E		10_2_0085E64E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00842FB0		10_2_00842FB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085DFF7		10_2_0085DFF7

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\cmstp.exe

Code function: String function: 0490B150 appears 35 times

Sample file is different than original file name gathered from version info

Source: 20210113432.exe, 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSoapName.dll2 vs 20210113432.exe
Source: 20210113432.exe, 00000000.00000002.254070147.0000000000A28000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePackingSize.exe: vs 20210113432.exe
Source: 20210113432.exe, 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamePositiveSign.dll< vs 20210113432.exe
Source: 20210113432.exe, 00000002.00000002.293261295.000000000167F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 20210113432.exe
Source: 20210113432.exe, 00000002.00000000.253368089.0000000000A48000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenamePackingSize.exe: vs 20210113432.exe
Source: 20210113432.exe, 00000002.00000002.292959417.000000000112A000.00000004.00000020.sdmp	Binary or memory string: OriginalFilenameCMSTP.EXE` vs 20210113432.exe
Source: 20210113432.exe	Binary or memory string: OriginalFilenamePackingSize.exe: vs 20210113432.exe

Uses 32bit PE files

Source: 20210113432.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Uses a Windows Living Off The Land Binaries (LOL bins)

Source: unknown

Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe

Yara signature match

Source: 00000002.00000002.292282705.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.292282705.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.292860797.0000000000FA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.292860797.0000000000FA0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.292893509.0000000000FD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.292893509.0000000000FD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.608235270.0000000000D60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.608235270.0000000000D60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.608474774.0000000000D90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.608474774.0000000000D90000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.606729919.0000000000840000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.606729919.0000000000840000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.20210113432.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.20210113432.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.20210113432.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.20210113432.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@6/3

Creates files inside the user directory

Source: C:\Users\user\Desktop\20210113432.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\20210113432.exe.log

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6328:120:WilError_01

PE file has an executable .text section and no other executable section

Source: 20210113432.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\20210113432.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\20210113432.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

SQL strings found in memory and binary data

Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Customer] SET [Address] = @Address, [Postal_Code] = @Postal_Code, [Country] = @Country, [C_ID] = @C_ID, [C_City] = @C_City, [C_Phone] = @C_Phone WHERE (((@IsNull_Address = 1 AND [Address] IS NULL) OR ([Address] = @Original_Address)) AND ((@IsNull_Postal_Code = 1 AND [Postal_Code] IS NULL) OR ([Postal_Code] = @Original_Postal_Code)) AND ((@IsNull_Country = 1 AND [Country] IS NULL) OR ([Country] = @Original_Country)) AND ([C_ID] = @Original_C_ID) AND ((@IsNull_C_City = 1 AND [C_City] IS NULL) OR ([C_City] = @Original_C_City)) AND ((@IsNull_C_Phone = 1 AND [C_Phone] IS NULL) OR ([C_Phone] = @Original_C_Phone)));
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [dbo].[Invoice] ([C_ID], [INV_ID], [M_ID], [Services_Cost], [Inv_Date], [Electr_Cost], [Water_Cost], [Total_Cost]) VALUES (@C_ID, @INV_ID, @M_ID, @Services_Cost, @Inv_Date, @Electr_Cost, @Water_Cost, @Total_Cost);
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [dbo].[Payment_Method] ([M_ID], [Method]) VALUES (@M_ID, @Method);
Source: 20210113432.exe	Binary or memory string: INSERT INTO [dbo].[Room_Type] ([TYPE_ID], [Name], [Description]) VALUES (@TYPE_ID, @Name, @Description); SELECT TYPE_ID, Name, Des
Source: 20210113432.exe	Binary or memory string: INSERT INTO [dbo].[Payment_Method] ([M_ID], [Method]) VALUES (@M_ID, @Method); SELECT M_ID, Method FROM Payment_Method WHERE (M_ID
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [dbo].[Services] ([Price], [Name], [Description], [Serv_Date], [S_ID]) VALUES (@Price, @Name, @Description, @Serv_Date, @S_ID);
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [dbo].[Customer] ([Address], [Postal_Code], [Country], [C_ID], [C_City], [C_Phone]) VALUES (@Address, @Postal_Code, @Country, @C_ID, @C_City, @C_Phone);
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Invoice] SET [C_ID] = @C_ID, [INV_ID] = @INV_ID, [M_ID] = @M_ID, [Services_Cost] = @Services_Cost, [Inv_Date] = @Inv_Date, [Electr_Cost] = @Electr_Cost, [Water_Cost] = @Water_Cost, [Total_Cost] = @Total_Cost WHERE (((@IsNull_C_ID = 1 AND [C_ID] IS NULL) OR ([C_ID] = @Original_C_ID)) AND ([INV_ID] = @Original_INV_ID) AND ((@IsNull_M_ID = 1 AND [M_ID] IS NULL) OR ([M_ID] = @Original_M_ID)) AND ((@IsNull_Services_Cost = 1 AND [Services_Cost] IS NULL) OR ([Services_Cost] = @Original_Services_Cost)) AND ((@IsNull_Inv_Date = 1 AND [Inv_Date] IS NULL) OR ([Inv_Date] = @Original_Inv_Date)) AND ((@IsNull_Electr_Cost = 1 AND [Electr_Cost] IS NULL) OR ([Electr_Cost] = @Original_Electr_Cost)) AND ((@IsNull_Water_Cost = 1 AND [Water_Cost] IS NULL) OR ([Water_Cost] = @Original_Water_Cost)) AND ((@IsNull_Total_Cost = 1 AND [Total_Cost] IS NULL) OR ([Total_Cost] = @Original_Total_Cost)));
Source: 20210113432.exe	Binary or memory string: INSERT INTO [dbo].[Person] ([First_Name], [Last_Name], [SIN]) VALUES (@First_Name, @Last_Name, @SIN); SELECT First_Name, Last_Name
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Person] SET [First_Name] = @First_Name, [Last_Name] = @Last_Name, [SIN] = @SIN WHERE (((@IsNull_First_Name = 1 AND [First_Name] IS NULL) OR ([First_Name] = @Original_First_Name)) AND ((@IsNull_Last_Name = 1 AND [Last_Name] IS NULL) OR ([Last_Name] = @Original_Last_Name)) AND ([SIN] = @Original_SIN));
Source: 20210113432.exe	Binary or memory string: INSERT INTO [dbo].[Employee] ([E_ID], [Position]) VALUES (@E_ID, @Position); SELECT E_ID, Position FROM Employee WHERE (E_ID = @E_
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: INSERT INTO [dbo].[Employee] ([E_ID], [Position]) VALUES (@E_ID, @Position);
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Payment_Method] SET [M_ID] = @M_ID, [Method] = @Method WHERE (([M_ID] = @Original_M_ID) AND ((@IsNull_Method = 1 AND [Method] IS NULL) OR ([Method] = @Original_Method)));
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Rooms] SET [R_ID] = @R_ID, [Price] = @Price, [Smoking_Allowed] = @Smoking_Allowed, [Description] = @Description, [Num_Of_Beds] = @Num_Of_Beds, [Floor] = @Floor WHERE (([R_ID] = @Original_R_ID) AND ((@IsNull_Price = 1 AND [Price] IS NULL) OR ([Price] = @Original_Price)) AND ((@IsNull_Smoking_Allowed = 1 AND [Smoking_Allowed] IS NULL) OR ([Smoking_Allowed] = @Original_Smoking_Allowed)) AND ((@IsNull_Description = 1 AND [Description] IS NULL) OR ([Description] = @Original_Description)) AND ((@IsNull_Num_Of_Beds = 1 AND [Num_Of_Beds] IS NULL) OR ([Num_Of_Beds] = @Original_Num_Of_Beds)) AND ((@IsNull_Floor = 1 AND [Floor] IS NULL) OR ([Floor] = @Original_Floor)));
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Room_Type] SET [TYPE_ID] = @TYPE_ID, [Name] = @Name, [Description] = @Description WHERE (([TYPE_ID] = @Original_TYPE_ID) AND ((@IsNull_Name = 1 AND [Name] IS NULL) OR ([Name] = @Original_Name)) AND ((@IsNull_Description = 1 AND [Description] IS NULL) OR ([Description] = @Original_Description)));
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Reservation] SET [C_ID] = @C_ID, [Date] = @Date, [RES_ID] = @RES_ID, [R_ID] = @R_ID, [Check_Out_Time] = @Check_Out_Time, [Check_In_Time] = @Check_In_Time WHERE (((@IsNull_C_ID = 1 AND [C_ID] IS NULL) OR ([C_ID] = @Original_C_ID)) AND ((@IsNull_Date = 1 AND [Date] IS NULL) OR ([Date] = @Original_Date)) AND ([RES_ID] = @Original_RES_ID) AND ((@IsNull_R_ID = 1 AND [R_ID] IS NULL) OR ([R_ID] = @Original_R_ID)) AND ((@IsNull_Check_Out_Time = 1 AND [Check_Out_Time] IS NULL) OR ([Check_Out_Time] = @Original_Check_Out_Time)) AND ((@IsNull_Check_In_Time = 1 AND [Check_In_Time] IS NULL) OR ([Check_In_Time] = @Original_Check_In_Time)));
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Employee] SET [E_ID] = @E_ID, [Position] = @Position WHERE (([E_ID] = @Original_E_ID) AND ((@IsNull_Position = 1 AND [Position] IS NULL) OR ([Position] = @Original_Position)));
Source: 20210113432.exe, 00000000.00000002.253951343.0000000000922000.00000002.00020000.sdmp, 20210113432.exe, 00000002.00000002.292323607.0000000000942000.00000002.00020000.sdmp	Binary or memory string: UPDATE [dbo].[Services] SET [Price] = @Price, [Name] = @Name, [Description] = @Description, [Serv_Date] = @Serv_Date, [S_ID] = @S_ID WHERE (((@IsNull_Price = 1 AND [Price] IS NULL) OR ([Price] = @Original_Price)) AND ((@IsNull_Name = 1 AND [Name] IS NULL) OR ([Name] = @Original_Name)) AND ((@IsNull_Description = 1 AND [Description] IS NULL) OR ([Description] = @Original_Description)) AND ((@IsNull_Serv_Date = 1 AND [Serv_Date] IS NULL) OR ([Serv_Date] = @Original_Serv_Date)) AND ([S_ID] = @Original_S_ID));

Sample is known by Antivirus

Source: 20210113432.exe	Virustotal: Detection: 28%
Source: 20210113432.exe	ReversingLabs: Detection: 26%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\20210113432.exe 'C:\Users\user\Desktop\20210113432.exe'
Source: unknown	Process created: C:\Users\user\Desktop\20210113432.exe C:\Users\user\Desktop\20210113432.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\20210113432.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\20210113432.exe	Process created: C:\Users\user\Desktop\20210113432.exe C:\Users\user\Desktop\20210113432.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\20210113432.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32

Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\20210113432.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: 20210113432.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

PE file has a big code size

Source: 20210113432.exe

Static PE information: Virtual size of .text is bigger than: 0x100000

Submission file is bigger than most known malware samples

Source: 20210113432.exe

Static file information: File size 1070592 > 1048576

PE file has a big raw section

Source: 20210113432.exe

Static PE information: Raw size of .text is bigger than: 0x100000 < 0x104a00

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 20210113432.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: cmstp.pdbGCTL source: 20210113432.exe, 00000002.00000002.292959417.000000000112A000.00000004.00000020.sdmp
Source:	Binary string: wntdll.pdbUGP source: 20210113432.exe, 00000002.00000002.293261295.000000000167F000.00000040.00000001.sdmp, cmstp.exe, 0000000A.00000002.610790458.00000000048E0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 20210113432.exe, 00000002.00000002.293261295.000000000167F000.00000040.00000001.sdmp, cmstp.exe
Source:	Binary string: cmstp.pdb source: 20210113432.exe, 00000002.00000002.292959417.000000000112A000.00000004.00000020.sdmp

Data Obfuscation:

.NET source code contains potential unpacker

Source: 20210113432.exe, LoaderInformation.cs	.Net Code: SafeFileMappingHandle System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.20210113432.exe.920000.0.unpack, LoaderInformation.cs	.Net Code: SafeFileMappingHandle System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.20210113432.exe.920000.0.unpack, LoaderInformation.cs	.Net Code: SafeFileMappingHandle System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.0.20210113432.exe.940000.0.unpack, LoaderInformation.cs	.Net Code: SafeFileMappingHandle System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 2.2.20210113432.exe.940000.1.unpack, LoaderInformation.cs	.Net Code: SafeFileMappingHandle System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\20210113432.exe	Code function: 0_2_0092DD3E push 6F060001h; iretd		0_2_0092DD52
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 0_2_0093862E push 00000000h; iretd		0_2_00938678
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 0_2_0092FB28 push 73000004h; retf		0_2_0092FB55
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00417800 push ebp; retf		2_2_0041780B
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0040D8D8 push edi; retf		2_2_0040D8DD
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00409B78 push ecx; ret		2_2_00409B80
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0040F3CD push FFFFFFB4h; ret		2_2_0040F3CF
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00417BEA push 00000042h; retf		2_2_00417BEC
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00409B78 push ecx; ret		2_2_00409B80
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041E47D push eax; ret		2_2_0041E5D4
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_00405DE5 pushfd ; iretd		2_2_00405DEE
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041CEF2 push eax; ret		2_2_0041CEF8
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041CEFB push eax; ret		2_2_0041CF62
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041CEA5 push eax; ret		2_2_0041CEF8
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041CF5C push eax; ret		2_2_0041CF62
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0041DFBD push 0000006Fh; ret		2_2_0041DFC1
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0094FB28 push 73000004h; retf		2_2_0094FB55
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0094DD3E push 6F060001h; iretd		2_2_0094DD52
Source: C:\Users\user\Desktop\20210113432.exe	Code function: 2_2_0095862E push 00000000h; iretd		2_2_00958678
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0495D0D1 push ecx; ret		10_2_0495D0E4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0084D8D8 push edi; retf		10_2_0084D8DD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00857800 push ebp; retf		10_2_0085780B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085D267 push ebx; ret		10_2_0085D275
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0084F3CD push FFFFFFB4h; ret		10_2_0084F3CF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00857BEA push 00000042h; retf		10_2_00857BEC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00849B78 push ecx; ret		10_2_00849B80
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085E47D push eax; ret		10_2_0085E5D4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_00845DE5 pushfd ; iretd		10_2_00845DEE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085CEA5 push eax; ret		10_2_0085CEF8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085CEF2 push eax; ret		10_2_0085CEF8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0085CEFB push eax; ret		10_2_0085CF62

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.02780570419

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x84 0x4E 0xE8

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM_3

Source: Yara match	File source: 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 20210113432.exe PID: 1476, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 20210113432.exe, 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL
Source: 20210113432.exe, 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp	Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\20210113432.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\20210113432.exe	RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe	RDTSC instruction interceptor: First address: 00000000008498E4 second address: 00000000008498EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe	RDTSC instruction interceptor: First address: 0000000000849B4E second address: 0000000000849B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\20210113432.exe

Code function: 2_2_00409A80 rdtsc

2_2_00409A80

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\20210113432.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\20210113432.exe TID: 4360	Thread sleep time: -52304s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe TID: 1416	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6680	Thread sleep count: 51 > 30			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6680	Thread sleep time: -102000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 5296	Thread sleep time: -110000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000003.00000000.278109788.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000003.00000000.278109788.0000000008A32000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: 20210113432.exe, 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp	Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000003.00000000.278276930.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.273368414.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 20210113432.exe, 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000003.00000000.278276930.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}e
Source: explorer.exe, 00000003.00000000.268046635.00000000048E0000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.278178947.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000Datc
Source: explorer.exe, 00000003.00000000.278276930.0000000008B88000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}C
Source: explorer.exe, 00000003.00000000.278178947.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000003.00000002.623832514.00000000069DE000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD002
Source: explorer.exe, 00000003.00000000.273368414.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.273368414.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 20210113432.exe, 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: 20210113432.exe, 00000000.00000002.254808962.0000000002E31000.00000004.00000001.sdmp	Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000003.00000000.273368414.00000000059C0000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\20210113432.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\20210113432.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\20210113432.exe

Code function: 2_2_00409A80 rdtsc

2_2_00409A80

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\20210113432.exe

Code function: 2_2_0040ACC0 LdrLoadDll,

2_2_0040ACC0

Contains functionality to read the PEB

Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491849B mov eax, dword ptr fs:[00000030h]		10_2_0491849B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04909080 mov eax, dword ptr fs:[00000030h]		10_2_04909080
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04983884 mov eax, dword ptr fs:[00000030h]		10_2_04983884
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04983884 mov eax, dword ptr fs:[00000030h]		10_2_04983884
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493F0BF mov ecx, dword ptr fs:[00000030h]		10_2_0493F0BF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493F0BF mov eax, dword ptr fs:[00000030h]		10_2_0493F0BF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493F0BF mov eax, dword ptr fs:[00000030h]		10_2_0493F0BF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h]		10_2_049320A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h]		10_2_049320A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h]		10_2_049320A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h]		10_2_049320A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h]		10_2_049320A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049320A0 mov eax, dword ptr fs:[00000030h]		10_2_049320A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049490AF mov eax, dword ptr fs:[00000030h]		10_2_049490AF
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0499B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499B8D0 mov ecx, dword ptr fs:[00000030h]		10_2_0499B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0499B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0499B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0499B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0499B8D0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D8CD6 mov eax, dword ptr fs:[00000030h]		10_2_049D8CD6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C14FB mov eax, dword ptr fs:[00000030h]		10_2_049C14FB
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986CF0 mov eax, dword ptr fs:[00000030h]		10_2_04986CF0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986CF0 mov eax, dword ptr fs:[00000030h]		10_2_04986CF0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986CF0 mov eax, dword ptr fs:[00000030h]		10_2_04986CF0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049058EC mov eax, dword ptr fs:[00000030h]		10_2_049058EC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D4015 mov eax, dword ptr fs:[00000030h]		10_2_049D4015
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D4015 mov eax, dword ptr fs:[00000030h]		10_2_049D4015
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04987016 mov eax, dword ptr fs:[00000030h]		10_2_04987016
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04987016 mov eax, dword ptr fs:[00000030h]		10_2_04987016
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04987016 mov eax, dword ptr fs:[00000030h]		10_2_04987016
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D740D mov eax, dword ptr fs:[00000030h]		10_2_049D740D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D740D mov eax, dword ptr fs:[00000030h]		10_2_049D740D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D740D mov eax, dword ptr fs:[00000030h]		10_2_049D740D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986C0A mov eax, dword ptr fs:[00000030h]		10_2_04986C0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986C0A mov eax, dword ptr fs:[00000030h]		10_2_04986C0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986C0A mov eax, dword ptr fs:[00000030h]		10_2_04986C0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986C0A mov eax, dword ptr fs:[00000030h]		10_2_04986C0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1C06 mov eax, dword ptr fs:[00000030h]		10_2_049C1C06
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491B02A mov eax, dword ptr fs:[00000030h]		10_2_0491B02A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491B02A mov eax, dword ptr fs:[00000030h]		10_2_0491B02A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491B02A mov eax, dword ptr fs:[00000030h]		10_2_0491B02A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491B02A mov eax, dword ptr fs:[00000030h]		10_2_0491B02A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h]		10_2_0493002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h]		10_2_0493002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h]		10_2_0493002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h]		10_2_0493002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493002D mov eax, dword ptr fs:[00000030h]		10_2_0493002D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493BC2C mov eax, dword ptr fs:[00000030h]		10_2_0493BC2C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04920050 mov eax, dword ptr fs:[00000030h]		10_2_04920050
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04920050 mov eax, dword ptr fs:[00000030h]		10_2_04920050
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499C450 mov eax, dword ptr fs:[00000030h]		10_2_0499C450
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499C450 mov eax, dword ptr fs:[00000030h]		10_2_0499C450
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493A44B mov eax, dword ptr fs:[00000030h]		10_2_0493A44B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D1074 mov eax, dword ptr fs:[00000030h]		10_2_049D1074
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C2073 mov eax, dword ptr fs:[00000030h]		10_2_049C2073
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492746D mov eax, dword ptr fs:[00000030h]		10_2_0492746D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932990 mov eax, dword ptr fs:[00000030h]		10_2_04932990
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493FD9B mov eax, dword ptr fs:[00000030h]		10_2_0493FD9B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493FD9B mov eax, dword ptr fs:[00000030h]		10_2_0493FD9B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492C182 mov eax, dword ptr fs:[00000030h]		10_2_0492C182
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932581 mov eax, dword ptr fs:[00000030h]		10_2_04932581
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932581 mov eax, dword ptr fs:[00000030h]		10_2_04932581
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932581 mov eax, dword ptr fs:[00000030h]		10_2_04932581
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932581 mov eax, dword ptr fs:[00000030h]		10_2_04932581
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493A185 mov eax, dword ptr fs:[00000030h]		10_2_0493A185
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h]		10_2_04902D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h]		10_2_04902D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h]		10_2_04902D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h]		10_2_04902D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04902D8A mov eax, dword ptr fs:[00000030h]		10_2_04902D8A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04931DB5 mov eax, dword ptr fs:[00000030h]		10_2_04931DB5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04931DB5 mov eax, dword ptr fs:[00000030h]		10_2_04931DB5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04931DB5 mov eax, dword ptr fs:[00000030h]		10_2_04931DB5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049851BE mov eax, dword ptr fs:[00000030h]		10_2_049851BE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049851BE mov eax, dword ptr fs:[00000030h]		10_2_049851BE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049851BE mov eax, dword ptr fs:[00000030h]		10_2_049851BE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049851BE mov eax, dword ptr fs:[00000030h]		10_2_049851BE
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D05AC mov eax, dword ptr fs:[00000030h]		10_2_049D05AC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D05AC mov eax, dword ptr fs:[00000030h]		10_2_049D05AC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049335A1 mov eax, dword ptr fs:[00000030h]		10_2_049335A1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049361A0 mov eax, dword ptr fs:[00000030h]		10_2_049361A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049361A0 mov eax, dword ptr fs:[00000030h]		10_2_049361A0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049869A6 mov eax, dword ptr fs:[00000030h]		10_2_049869A6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h]		10_2_04986DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h]		10_2_04986DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h]		10_2_04986DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986DC9 mov ecx, dword ptr fs:[00000030h]		10_2_04986DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h]		10_2_04986DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04986DC9 mov eax, dword ptr fs:[00000030h]		10_2_04986DC9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049B8DF1 mov eax, dword ptr fs:[00000030h]		10_2_049B8DF1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490B1E1 mov eax, dword ptr fs:[00000030h]		10_2_0490B1E1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490B1E1 mov eax, dword ptr fs:[00000030h]		10_2_0490B1E1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490B1E1 mov eax, dword ptr fs:[00000030h]		10_2_0490B1E1
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049941E8 mov eax, dword ptr fs:[00000030h]		10_2_049941E8
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491D5E0 mov eax, dword ptr fs:[00000030h]		10_2_0491D5E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491D5E0 mov eax, dword ptr fs:[00000030h]		10_2_0491D5E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CFDE2 mov eax, dword ptr fs:[00000030h]		10_2_049CFDE2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CFDE2 mov eax, dword ptr fs:[00000030h]		10_2_049CFDE2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CFDE2 mov eax, dword ptr fs:[00000030h]		10_2_049CFDE2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CFDE2 mov eax, dword ptr fs:[00000030h]		10_2_049CFDE2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04909100 mov eax, dword ptr fs:[00000030h]		10_2_04909100
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04909100 mov eax, dword ptr fs:[00000030h]		10_2_04909100
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04909100 mov eax, dword ptr fs:[00000030h]		10_2_04909100
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490AD30 mov eax, dword ptr fs:[00000030h]		10_2_0490AD30
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04913D34 mov eax, dword ptr fs:[00000030h]		10_2_04913D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CE539 mov eax, dword ptr fs:[00000030h]		10_2_049CE539
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04934D3B mov eax, dword ptr fs:[00000030h]		10_2_04934D3B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04934D3B mov eax, dword ptr fs:[00000030h]		10_2_04934D3B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04934D3B mov eax, dword ptr fs:[00000030h]		10_2_04934D3B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D8D34 mov eax, dword ptr fs:[00000030h]		10_2_049D8D34
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493513A mov eax, dword ptr fs:[00000030h]		10_2_0493513A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493513A mov eax, dword ptr fs:[00000030h]		10_2_0493513A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0498A537 mov eax, dword ptr fs:[00000030h]		10_2_0498A537
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04924120 mov eax, dword ptr fs:[00000030h]		10_2_04924120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04924120 mov eax, dword ptr fs:[00000030h]		10_2_04924120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04924120 mov eax, dword ptr fs:[00000030h]		10_2_04924120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04924120 mov eax, dword ptr fs:[00000030h]		10_2_04924120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04924120 mov ecx, dword ptr fs:[00000030h]		10_2_04924120
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04927D50 mov eax, dword ptr fs:[00000030h]		10_2_04927D50
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492B944 mov eax, dword ptr fs:[00000030h]		10_2_0492B944
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492B944 mov eax, dword ptr fs:[00000030h]		10_2_0492B944
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04943D43 mov eax, dword ptr fs:[00000030h]		10_2_04943D43
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04983540 mov eax, dword ptr fs:[00000030h]		10_2_04983540
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490B171 mov eax, dword ptr fs:[00000030h]		10_2_0490B171
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490B171 mov eax, dword ptr fs:[00000030h]		10_2_0490B171
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492C577 mov eax, dword ptr fs:[00000030h]		10_2_0492C577
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492C577 mov eax, dword ptr fs:[00000030h]		10_2_0492C577
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490C962 mov eax, dword ptr fs:[00000030h]		10_2_0490C962
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493D294 mov eax, dword ptr fs:[00000030h]		10_2_0493D294
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493D294 mov eax, dword ptr fs:[00000030h]		10_2_0493D294
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499FE87 mov eax, dword ptr fs:[00000030h]		10_2_0499FE87
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491AAB0 mov eax, dword ptr fs:[00000030h]		10_2_0491AAB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491AAB0 mov eax, dword ptr fs:[00000030h]		10_2_0491AAB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493FAB0 mov eax, dword ptr fs:[00000030h]		10_2_0493FAB0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h]		10_2_049052A5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h]		10_2_049052A5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h]		10_2_049052A5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h]		10_2_049052A5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049052A5 mov eax, dword ptr fs:[00000030h]		10_2_049052A5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D0EA5 mov eax, dword ptr fs:[00000030h]		10_2_049D0EA5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D0EA5 mov eax, dword ptr fs:[00000030h]		10_2_049D0EA5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D0EA5 mov eax, dword ptr fs:[00000030h]		10_2_049D0EA5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049846A7 mov eax, dword ptr fs:[00000030h]		10_2_049846A7
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D8ED6 mov eax, dword ptr fs:[00000030h]		10_2_049D8ED6
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04948EC7 mov eax, dword ptr fs:[00000030h]		10_2_04948EC7
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932ACB mov eax, dword ptr fs:[00000030h]		10_2_04932ACB
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049BFEC0 mov eax, dword ptr fs:[00000030h]		10_2_049BFEC0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049336CC mov eax, dword ptr fs:[00000030h]		10_2_049336CC
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049316E0 mov ecx, dword ptr fs:[00000030h]		10_2_049316E0
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049176E2 mov eax, dword ptr fs:[00000030h]		10_2_049176E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932AE4 mov eax, dword ptr fs:[00000030h]		10_2_04932AE4
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04905210 mov eax, dword ptr fs:[00000030h]		10_2_04905210
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04905210 mov ecx, dword ptr fs:[00000030h]		10_2_04905210
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04905210 mov eax, dword ptr fs:[00000030h]		10_2_04905210
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04905210 mov eax, dword ptr fs:[00000030h]		10_2_04905210
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490AA16 mov eax, dword ptr fs:[00000030h]		10_2_0490AA16
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490AA16 mov eax, dword ptr fs:[00000030h]		10_2_0490AA16
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04923A1C mov eax, dword ptr fs:[00000030h]		10_2_04923A1C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493A61C mov eax, dword ptr fs:[00000030h]		10_2_0493A61C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493A61C mov eax, dword ptr fs:[00000030h]		10_2_0493A61C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490C600 mov eax, dword ptr fs:[00000030h]		10_2_0490C600
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490C600 mov eax, dword ptr fs:[00000030h]		10_2_0490C600
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490C600 mov eax, dword ptr fs:[00000030h]		10_2_0490C600
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04938E00 mov eax, dword ptr fs:[00000030h]		10_2_04938E00
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C1608 mov eax, dword ptr fs:[00000030h]		10_2_049C1608
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04918A0A mov eax, dword ptr fs:[00000030h]		10_2_04918A0A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049BFE3F mov eax, dword ptr fs:[00000030h]		10_2_049BFE3F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490E620 mov eax, dword ptr fs:[00000030h]		10_2_0490E620
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04944A2C mov eax, dword ptr fs:[00000030h]		10_2_04944A2C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04944A2C mov eax, dword ptr fs:[00000030h]		10_2_04944A2C
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CEA55 mov eax, dword ptr fs:[00000030h]		10_2_049CEA55
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04994257 mov eax, dword ptr fs:[00000030h]		10_2_04994257
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04909240 mov eax, dword ptr fs:[00000030h]		10_2_04909240
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04909240 mov eax, dword ptr fs:[00000030h]		10_2_04909240
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04909240 mov eax, dword ptr fs:[00000030h]		10_2_04909240
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04909240 mov eax, dword ptr fs:[00000030h]		10_2_04909240
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h]		10_2_04917E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h]		10_2_04917E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h]		10_2_04917E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h]		10_2_04917E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h]		10_2_04917E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04917E41 mov eax, dword ptr fs:[00000030h]		10_2_04917E41
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CAE44 mov eax, dword ptr fs:[00000030h]		10_2_049CAE44
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049CAE44 mov eax, dword ptr fs:[00000030h]		10_2_049CAE44
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h]		10_2_0492AE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h]		10_2_0492AE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h]		10_2_0492AE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h]		10_2_0492AE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492AE73 mov eax, dword ptr fs:[00000030h]		10_2_0492AE73
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0494927A mov eax, dword ptr fs:[00000030h]		10_2_0494927A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049BB260 mov eax, dword ptr fs:[00000030h]		10_2_049BB260
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049BB260 mov eax, dword ptr fs:[00000030h]		10_2_049BB260
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491766D mov eax, dword ptr fs:[00000030h]		10_2_0491766D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D8A62 mov eax, dword ptr fs:[00000030h]		10_2_049D8A62
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493B390 mov eax, dword ptr fs:[00000030h]		10_2_0493B390
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04932397 mov eax, dword ptr fs:[00000030h]		10_2_04932397
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04918794 mov eax, dword ptr fs:[00000030h]		10_2_04918794
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04987794 mov eax, dword ptr fs:[00000030h]		10_2_04987794
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04987794 mov eax, dword ptr fs:[00000030h]		10_2_04987794
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04987794 mov eax, dword ptr fs:[00000030h]		10_2_04987794
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C138A mov eax, dword ptr fs:[00000030h]		10_2_049C138A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049BD380 mov ecx, dword ptr fs:[00000030h]		10_2_049BD380
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04911B8F mov eax, dword ptr fs:[00000030h]		10_2_04911B8F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04911B8F mov eax, dword ptr fs:[00000030h]		10_2_04911B8F
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D5BA5 mov eax, dword ptr fs:[00000030h]		10_2_049D5BA5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04934BAD mov eax, dword ptr fs:[00000030h]		10_2_04934BAD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04934BAD mov eax, dword ptr fs:[00000030h]		10_2_04934BAD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04934BAD mov eax, dword ptr fs:[00000030h]		10_2_04934BAD
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049853CA mov eax, dword ptr fs:[00000030h]		10_2_049853CA
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049853CA mov eax, dword ptr fs:[00000030h]		10_2_049853CA
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049437F5 mov eax, dword ptr fs:[00000030h]		10_2_049437F5
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h]		10_2_049303E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h]		10_2_049303E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h]		10_2_049303E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h]		10_2_049303E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h]		10_2_049303E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049303E2 mov eax, dword ptr fs:[00000030h]		10_2_049303E2
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492DBE9 mov eax, dword ptr fs:[00000030h]		10_2_0492DBE9
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0492F716 mov eax, dword ptr fs:[00000030h]		10_2_0492F716
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049C131B mov eax, dword ptr fs:[00000030h]		10_2_049C131B
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499FF10 mov eax, dword ptr fs:[00000030h]		10_2_0499FF10
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0499FF10 mov eax, dword ptr fs:[00000030h]		10_2_0499FF10
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D070D mov eax, dword ptr fs:[00000030h]		10_2_049D070D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D070D mov eax, dword ptr fs:[00000030h]		10_2_049D070D
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493A70E mov eax, dword ptr fs:[00000030h]		10_2_0493A70E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493A70E mov eax, dword ptr fs:[00000030h]		10_2_0493A70E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0493E730 mov eax, dword ptr fs:[00000030h]		10_2_0493E730
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04904F2E mov eax, dword ptr fs:[00000030h]		10_2_04904F2E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04904F2E mov eax, dword ptr fs:[00000030h]		10_2_04904F2E
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D8B58 mov eax, dword ptr fs:[00000030h]		10_2_049D8B58
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490F358 mov eax, dword ptr fs:[00000030h]		10_2_0490F358
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490DB40 mov eax, dword ptr fs:[00000030h]		10_2_0490DB40
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491EF40 mov eax, dword ptr fs:[00000030h]		10_2_0491EF40
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04933B7A mov eax, dword ptr fs:[00000030h]		10_2_04933B7A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_04933B7A mov eax, dword ptr fs:[00000030h]		10_2_04933B7A
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0490DB60 mov ecx, dword ptr fs:[00000030h]		10_2_0490DB60
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_0491FF60 mov eax, dword ptr fs:[00000030h]		10_2_0491FF60
Source: C:\Windows\SysWOW64\cmstp.exe	Code function: 10_2_049D8F6A mov eax, dword ptr fs:[00000030h]		10_2_049D8F6A

Enables debug privileges

Source: C:\Users\user\Desktop\20210113432.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process token adjusted: Debug			Jump to behavior

Creates guard pages, often used to prevent reverse engineering and debugging

Source: C:\Users\user\Desktop\20210113432.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 184.168.131.241 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 74.208.236.28 80			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\20210113432.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\20210113432.exe	Thread register set: target process: 3292			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Thread register set: target process: 3292			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\20210113432.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\20210113432.exe

Section unmapped: C:\Windows\SysWOW64\cmstp.exe base address: DE0000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\20210113432.exe	Process created: C:\Users\user\Desktop\20210113432.exe C:\Users\user\Desktop\20210113432.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\20210113432.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000003.00000000.258758513.0000000001400000.00000002.00000001.sdmp, cmstp.exe, 0000000A.00000002.610144193.0000000003190000.00000002.00000001.sdmp	Binary or memory string: uProgram Manager
Source: explorer.exe, 00000003.00000002.623472452.0000000005F40000.00000004.00000001.sdmp, cmstp.exe, 0000000A.00000002.610144193.0000000003190000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.258758513.0000000001400000.00000002.00000001.sdmp, cmstp.exe, 0000000A.00000002.610144193.0000000003190000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000003.00000002.607576651.0000000000EB8000.00000004.00000020.sdmp	Binary or memory string: ProgmanX
Source: explorer.exe, 00000003.00000000.258758513.0000000001400000.00000002.00000001.sdmp, cmstp.exe, 0000000A.00000002.610144193.0000000003190000.00000002.00000001.sdmp	Binary or memory string: Progmanlock
Source: explorer.exe, 00000003.00000000.278178947.0000000008ACF000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWndAj

Language, Device and Operating System Detection:

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\20210113432.exe	Queries volume information: C:\Users\user\Desktop\20210113432.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\20210113432.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation			Jump to behavior

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\20210113432.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000002.00000002.292282705.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292860797.0000000000FA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292893509.0000000000FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.608235270.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.608474774.0000000000D90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.606729919.0000000000840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.20210113432.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.20210113432.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000002.00000002.292282705.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292860797.0000000000FA0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.292893509.0000000000FD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.608235270.0000000000D60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.608474774.0000000000D90000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000000.00000002.255709550.0000000003E39000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.606729919.0000000000840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.2.20210113432.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.20210113432.exe.400000.0.raw.unpack, type: UNPACKEDPE