Analysis Report RRW9901200241.exe

Overview

General Information

Sample Name: RRW9901200241.exe
Analysis ID: 339369
MD5: 61ffb4ad4721f51413075923b2e9468d
SHA1: aa9ca98955157ca28bdbb1d8d29c3d1af2e28023
SHA256: 546e873e9e746eeee9cbed391ff7463ce192091ee0ff51c076291da5d836f64f
Tags: exeFormbook

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus / Scanner detection for submitted sample
Antivirus detection for URL or domain
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to communicate with device drivers
Contains functionality to dynamically determine API calls
Contains functionality to launch a process as a different user
Contains functionality to query CPU information (cpuid)
Contains functionality to query locales information (e.g. system language)
Contains functionality to read the PEB
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus / Scanner detection for submitted sample
Source: RRW9901200241.exe Avira: detected
Antivirus detection for URL or domain
Source: http://www.unitvn.com/krc/?Bv=yIa+94l9rzehTYM3PiVfcRiVsqTAPcUdvzwZbg1xcjwMDM0Vsi/KUjipuHGUDzRPALJr1HG4xA==&J494p=ARALpBVpxtEXKvT0 Avira URL Cloud: Label: malware
Found malware configuration
Source: 0.2.RRW9901200241.exe.1a00000.2.unpack Malware Configuration Extractor: FormBook {"Config: ": ["CONFIG_PATTERNS 0x8bbd", "KEY1_OFFSET 0x1d5b1", "CONFIG SIZE : 0xa9", "CONFIG OFFSET 0x1d6ae", "URL SIZE : 20", "searching string pattern", "strings_offset 0x1c193", "searching hashes pattern", "--------------------------------------------------", "Decrypted Function Hashes", "--------------------------------------------------", "0x891aaffb", "0xf43668a6", "0x980476e5", "0x35a6d50c", "0xf89290dc", "0x94261f57", "0x7d54c891", "0x47cb721", "0xf72d70d3", "0x9f715020", "0xbf0a5e41", "0x2902d074", "0xf653b199", "0xc8c42cc6", "0x2e1b7599", "0x210d4d07", "0x6d2a7921", "0x8ea85a2f", "0x207c50ff", "0xb967410a", "0x1eb17415", "0xb46802f8", "0x11da8518", "0xf42ed5c", "0x2885a3d3", "0x445675fa", "0x5c289b4c", "0x40ede5aa", "0xf24946a2", "0x8559c3e2", "0xb9d34d23", "0xa14d0a19", "0x2d07bbe2", "0xbbd1d68c", "0xb28c29d4", "0x3911edeb", "0xefad046d", "0xa0605497", "0xf5529cbf", "0x5507576a", "0xfa2467c8", "0x5b6423bf", "0xe22409b9", "0xde1eba2", "0xae847e2", "0xa8cfcc9", "0x26fc2c69", "0x5d8a75ac", "0x22eb3474", "0x2b37c918", "0x79402007", "0x7544791c", "0x641b2c94", "0x1db04ecf", "0xf5d02cd8", "0xad0121f4", "0x6206e716", "0x5e4b9b9a", "0xe4e2f5f4", "0x54c93159", "0x25ea79b", "0x5bf29119", "0xd6507db", "0x32ffc9f8", "0xe4cfab72", "0x98db5380", "0xce4cc542", "0x3092a0a2", "0x66053660", "0x2607a133", "0xfcd01449", "0x80b41d4", "0x4102ad8d", "0x857bf6a6", "0xd3ec6064", "0x23145fc4", "0xc026698f", "0x8f5385d8", "0x2430512b", "0x3ebe9086", "0x4c6fddb5", "0x276db13e", "0xe00f0a8e", "0x85cf9404", "0xb2248784", "0xcdc7e023", "0x11f5f50", "0x1dd4bc1c", "0x8235fce2", "0x21b17672", "0xbba64d93", "0x2f0ee0d8", "0x9cb95240", "0x28c21e3f", "0x9347ac57", "0x9d9522dc", "0x911bc70e", "0x74443db9", "0xf04c1aa9", "0x6484bcb5", "0x11fc2f72", "0x2b44324f", "0x9d70beea", "0x59adf952", "0x172ac7b4", "0x5d4b4e66", "0xed297eae", "0xa88492a6", "0xb21b057c", "0x70f35767", "0xb6f4d5a8", "0x67cea859", "0xc1626bff", "0xb4e1ae2", "0x24a48dcf", "0xe11da208", "0x1c920818", "0x65f4449c", "0xc30bc050", "0x3e86e1fb", "0x9e01fc32", "0x216500c2", "0x48e207c9", "0x2decf13e", "0x19996921", "0xb7da3dd7", "0x47f39d2b", "0x6777e2de", "0xd980e37f", "0x963fea3b", "0xacddb7ea", "0x110aec35", "0x647331f3", "0x2e381da4", "0x50f66474", "0xec16e0c0", "0xf9d81a42", "0xd6c6f9db", "0xef3df91", "0x60e0e203", "0x7c81caaf", "0x71c2ec76", "0x25e431cc", "0x106f568f", "0x6a60c8a9", "0xb758aab3", "0x3b34de90", "0x700420f5", "0xee359a7e", "0xd1d808a", "0x47ba47a5", "0xff959c4c", "0x5d30a87d", "0xaa95a900", "0x80b19064", "0x9c5a481a", "0x1dd252d", "0xdb3055fc", "0xe0cf8bf1", "0x3a48eabc", "0xf0472f97", "0x4a6323de", "0x4260edca", "0x53f7fb4f", "0x3d2e9c99", "0xf6879235", "0xe6723cac", "0xe184dfaa", "0xe99ffaa0", "0xf6aebe25", "0xefadf9a5", "0x215de938", "0x757906aa", "0x84f8d766", "0xb6494f65", "0x13a75318", "0x5bde5587", "0xe9eba2a4", "0x6b8a0df3", "0x9c02f250", "0xe52a2a2e", "0xdb96173c", "0x3c0f2fc", "0xd45e157c", "0x4edd1210", "0x2b127ce0", "0xadc887b6", "0xf45a1c52", "0xc84869d7", "0x36dc1f04",
Multi AV Scanner detection for submitted file
Source: RRW9901200241.exe ReversingLabs: Detection: 34%
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.383682726.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.341808975.0000000001A00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.677144358.0000000000370000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.677857555.00000000027D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.382481853.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.383234162.0000000001000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.RRW9901200241.exe.1a00000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RRW9901200241.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.RRW9901200241.exe.1a00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RRW9901200241.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: RRW9901200241.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 0.2.RRW9901200241.exe.1a00000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.RRW9901200241.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: RRW9901200241.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: RRW9901200241.exe Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.363251700.0000000007CA0000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: RRW9901200241.exe, 00000000.00000003.337251978.000000001B070000.00000004.00000001.sdmp, RRW9901200241.exe, 00000002.00000002.384345094.00000000015EF000.00000040.00000001.sdmp, cmd.exe, 00000004.00000002.678905716.000000000308F000.00000040.00000001.sdmp
Source: Binary string: cmd.pdbUGP source: RRW9901200241.exe, 00000002.00000003.381525500.0000000001081000.00000004.00000001.sdmp, cmd.exe, 00000004.00000002.676959985.00000000002A0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RRW9901200241.exe, cmd.exe
Source: Binary string: cmd.pdb source: RRW9901200241.exe, 00000002.00000003.381525500.0000000001081000.00000004.00000001.sdmp, cmd.exe
Source: Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.363251700.0000000007CA0000.00000002.00000001.sdmp
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B245C FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove, 4_2_002B245C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B68BA FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose, 4_2_002B68BA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AB89C GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose, 4_2_002AB89C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A85EA memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 4_2_002A85EA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002C31DC FindFirstFileW,FindNextFileW,FindClose, 4_2_002C31DC

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 4x nop then pop edi 2_2_00417D6E

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49748 -> 161.35.25.247:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49748 -> 161.35.25.247:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49748 -> 161.35.25.247:80
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /krc/?Bv=CDu2q1wwlPol/aaE7LTgnX8K53P3sg99O/jiiFC4V2fCANwRdAJcp+ZFqaBz9HB2y9P2V6qKww==&J494p=ARALpBVpxtEXKvT0 HTTP/1.1Host: www.7852bigbucktrail.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /krc/?Bv=idO/LAWRhq8eaiStiRRR14QihBlHCWd10ZsS07gNigVsPM/nj7NW3DcAwcUnOO2Dm4jIcS3FWg==&J494p=ARALpBVpxtEXKvT0 HTTP/1.1Host: www.toastxpress.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /krc/?Bv=yIa+94l9rzehTYM3PiVfcRiVsqTAPcUdvzwZbg1xcjwMDM0Vsi/KUjipuHGUDzRPALJr1HG4xA==&J494p=ARALpBVpxtEXKvT0 HTTP/1.1Host: www.unitvn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: SUPERDATA-AS-VNSUPERDATA-VN SUPERDATA-AS-VNSUPERDATA-VN
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: Joe Sandbox View ASN Name: AMAZON-AESUS AMAZON-AESUS
Source: global traffic HTTP traffic detected: GET /krc/?Bv=CDu2q1wwlPol/aaE7LTgnX8K53P3sg99O/jiiFC4V2fCANwRdAJcp+ZFqaBz9HB2y9P2V6qKww==&J494p=ARALpBVpxtEXKvT0 HTTP/1.1Host: www.7852bigbucktrail.infoConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /krc/?Bv=idO/LAWRhq8eaiStiRRR14QihBlHCWd10ZsS07gNigVsPM/nj7NW3DcAwcUnOO2Dm4jIcS3FWg==&J494p=ARALpBVpxtEXKvT0 HTTP/1.1Host: www.toastxpress.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /krc/?Bv=yIa+94l9rzehTYM3PiVfcRiVsqTAPcUdvzwZbg1xcjwMDM0Vsi/KUjipuHGUDzRPALJr1HG4xA==&J494p=ARALpBVpxtEXKvT0 HTTP/1.1Host: www.unitvn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.7852bigbucktrail.info
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundConnection: closeCache-Control: private, no-cache, no-store, must-revalidate, max-age=0Pragma: no-cacheContent-Type: text/htmlContent-Length: 1237Date: Wed, 13 Jan 2021 20:49:10 GMTServer: LiteSpeedData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 31 30 30 25 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 73 68 72 69 6e 6b 2d 74 6f 2d 66 69 74 3d 6e 6f 22 20 3e 0a 3c 74 69 74 6c 65 3e 20 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 20 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 3a 20 6e 6f 72 6d 61 6c 20 31 34 70 78 2f 32 30 70 78 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 20 68 65 69 67 68 74 3a 31 30 30 25 3b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 22 3e 0a 3c 64 69 76 20 73 74 79 6c 65 3d 22 68 65 69 67 68 74 3a 61 75 74 6f 3b 20 6d 69 6e 2d 68 65 69 67 68 74 3a 31 30 30 25 3b 20 22 3e 20 20 20 20 20 3c 64 69 76 20 73 74 79 6c 65 3d 22 74 65 78 74 2d 61 6c 69 67 6e 3a 20 63 65 6e 74 65 72 3b 20 77 69 64 74 68 3a 38 30 30 70 78 3b 20 6d 61 72 67 69 6e 2d 6c 65 66 74 3a 20 2d 34 30 30 70 78 3b 20 70 6f 73 69 74 69 6f 6e 3a 61 62 73 6f 6c 75 74 65 3b 20 74 6f 70 3a 20 33 30 25 3b 20 6c 65 66 74 3a 35 30 25 3b 22 3e 0a 20 20 20 20 20 20 20 20 3c 68 31 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 3a 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 35 30 70 78 3b 20 6c 69 6e 65 2d 68 65 69 67 68 74 3a 31 35 30 70 78 3b 20 66 6f 6e 74 2d 77 65 69 67 68 74 3a 62 6f 6c 64 3b 22 3e 34 30 34 3c 2f 68 31 3e 0a 3c 68 32 20 73 74 79 6c 65 3d 22 6d 61 72 67 69 6e 2d 74 6f 70 3a 32 30 70 78 3b 66 6f 6e 74 2d 73 69 7a 65 3a 20 33 30 70 78 3b 22 3e 4e 6f 74 20 46 6f 75 6e 64 0d 0a 3c 2f 68 32 3e 0a 3c 70 3e 54 68 65 20 72 65 73 6f 75 72 63 65 20 72 65 71 75 65 73 74 65 64 20 63 6f 75 6c 64 20 6e 6f 74 20 62 65 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 21 3c 2f 70 3e 0a 3c 2f 64 69 76 3e 3c 2f 64 69 76 3e 3c 64 69 76 20 73 74 79 6c 65 3d 22 63 6f 6c 6f 72 3a 23 66 30 66 30 66 30 3b 20 66 6f 6e 74 2d 73 69 7a 65 3a 31 32 70 78 3b 6d 61 72 67 69 6e 3a 61 75 74 6f 3b 70 61 64 64 69 6e 67 3a 30 70 78 20 33 30 70 78 20 30 70 78 20 33 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 63 6c 65 61 72 3a 62 6f 74 68 3b 68 65 69 67 68 74 3a 31 30 30 70 78 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 2d 31 30 31 70 78 3b 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 37 34 37 34 37 3b 62 6f 72 64 65 72 2d 74 6f 70 3a 20 31 70 78 20 73 6f 6c 69 64 20 72 67 62 61 28 30 2c 30 2c 30 2c 30 2e 31 35 29 3b 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 31 70 78 20 30 20 72 67
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000000.346593091.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: cmd.exe, 00000004.00000002.679859333.0000000003A2F000.00000004.00000001.sdmp String found in binary or memory: http://www.litespeedtech.com/error-page
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.369240129.000000000B1A6000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.383682726.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.341808975.0000000001A00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.677144358.0000000000370000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.677857555.00000000027D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.382481853.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.383234162.0000000001000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.RRW9901200241.exe.1a00000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RRW9901200241.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.RRW9901200241.exe.1a00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RRW9901200241.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000002.00000002.383682726.0000000001030000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.383682726.0000000001030000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.341808975.0000000001A00000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.341808975.0000000001A00000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.677144358.0000000000370000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.677144358.0000000000370000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.677857555.00000000027D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.677857555.00000000027D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.382481853.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.382481853.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.383234162.0000000001000000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.383234162.0000000001000000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.RRW9901200241.exe.1a00000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.RRW9901200241.exe.1a00000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.RRW9901200241.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.RRW9901200241.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.RRW9901200241.exe.1a00000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.RRW9901200241.exe.1a00000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.RRW9901200241.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.RRW9901200241.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00419D50 NtCreateFile, 2_2_00419D50
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00419E00 NtReadFile, 2_2_00419E00
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00419E80 NtClose, 2_2_00419E80
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00419F30 NtAllocateVirtualMemory, 2_2_00419F30
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00419E4C NtReadFile, 2_2_00419E4C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00419F2E NtAllocateVirtualMemory, 2_2_00419F2E
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539910 NtAdjustPrivilegesToken,LdrInitializeThunk, 2_2_01539910
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015399A0 NtCreateSection,LdrInitializeThunk, 2_2_015399A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539840 NtDelayExecution,LdrInitializeThunk, 2_2_01539840
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539860 NtQuerySystemInformation,LdrInitializeThunk, 2_2_01539860
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015398F0 NtReadVirtualMemory,LdrInitializeThunk, 2_2_015398F0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539A50 NtCreateFile,LdrInitializeThunk, 2_2_01539A50
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539A00 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_01539A00
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539A20 NtResumeThread,LdrInitializeThunk, 2_2_01539A20
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539540 NtReadFile,LdrInitializeThunk, 2_2_01539540
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015395D0 NtClose,LdrInitializeThunk, 2_2_015395D0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539710 NtQueryInformationToken,LdrInitializeThunk, 2_2_01539710
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539780 NtMapViewOfSection,LdrInitializeThunk, 2_2_01539780
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015397A0 NtUnmapViewOfSection,LdrInitializeThunk, 2_2_015397A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539660 NtAllocateVirtualMemory,LdrInitializeThunk, 2_2_01539660
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015396E0 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_015396E0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539950 NtQueueApcThread, 2_2_01539950
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015399D0 NtCreateProcessEx, 2_2_015399D0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0153B040 NtSuspendThread, 2_2_0153B040
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539820 NtEnumerateKey, 2_2_01539820
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015398A0 NtWriteVirtualMemory, 2_2_015398A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539B00 NtSetValueKey, 2_2_01539B00
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0153A3B0 NtGetContextThread, 2_2_0153A3B0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539A10 NtQuerySection, 2_2_01539A10
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539A80 NtOpenDirectoryObject, 2_2_01539A80
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539560 NtWriteFile, 2_2_01539560
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0153AD30 NtSetContextThread, 2_2_0153AD30
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539520 NtWaitForSingleObject, 2_2_01539520
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015395F0 NtQueryInformationFile, 2_2_015395F0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539770 NtSetInformationFile, 2_2_01539770
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0153A770 NtOpenThread, 2_2_0153A770
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539760 NtOpenProcess, 2_2_01539760
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0153A710 NtOpenProcessToken, 2_2_0153A710
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539730 NtQueryVirtualMemory, 2_2_01539730
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539FE0 NtCreateMutant, 2_2_01539FE0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539650 NtQueryValueKey, 2_2_01539650
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539670 NtQueryInformationProcess, 2_2_01539670
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01539610 NtEnumerateValueKey, 2_2_01539610
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015396D0 NtCreateKey, 2_2_015396D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AB42E NtOpenThreadToken,NtOpenProcessToken,NtClose, 4_2_002AB42E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A58A4 _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp, 4_2_002A58A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A84BE NtQueryVolumeInformationFile,GetFileInformationByHandleEx, 4_2_002A84BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AB4F8 NtQueryInformationToken,NtQueryInformationToken, 4_2_002AB4F8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AB4C0 NtQueryInformationToken, 4_2_002AB4C0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002C6D90 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer, 4_2_002C6D90
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002CB5E0 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW, 4_2_002CB5E0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002C9AB4 NtSetInformationFile, 4_2_002C9AB4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A83F2 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError, 4_2_002A83F2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9A50 NtCreateFile,LdrInitializeThunk, 4_2_02FD9A50
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9860 NtQuerySystemInformation,LdrInitializeThunk, 4_2_02FD9860
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9840 NtDelayExecution,LdrInitializeThunk, 4_2_02FD9840
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD99A0 NtCreateSection,LdrInitializeThunk, 4_2_02FD99A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 4_2_02FD9910
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD96E0 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_02FD96E0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD96D0 NtCreateKey,LdrInitializeThunk, 4_2_02FD96D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9FE0 NtCreateMutant,LdrInitializeThunk, 4_2_02FD9FE0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9780 NtMapViewOfSection,LdrInitializeThunk, 4_2_02FD9780
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9710 NtQueryInformationToken,LdrInitializeThunk, 4_2_02FD9710
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD95D0 NtClose,LdrInitializeThunk, 4_2_02FD95D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9540 NtReadFile,LdrInitializeThunk, 4_2_02FD9540
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9A80 NtOpenDirectoryObject, 4_2_02FD9A80
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9A20 NtResumeThread, 4_2_02FD9A20
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9A10 NtQuerySection, 4_2_02FD9A10
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9A00 NtProtectVirtualMemory, 4_2_02FD9A00
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FDA3B0 NtGetContextThread, 4_2_02FDA3B0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9B00 NtSetValueKey, 4_2_02FD9B00
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD98F0 NtReadVirtualMemory, 4_2_02FD98F0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD98A0 NtWriteVirtualMemory, 4_2_02FD98A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FDB040 NtSuspendThread, 4_2_02FDB040
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9820 NtEnumerateKey, 4_2_02FD9820
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD99D0 NtCreateProcessEx, 4_2_02FD99D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9950 NtQueueApcThread, 4_2_02FD9950
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9670 NtQueryInformationProcess, 4_2_02FD9670
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9660 NtAllocateVirtualMemory, 4_2_02FD9660
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9650 NtQueryValueKey, 4_2_02FD9650
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9610 NtEnumerateValueKey, 4_2_02FD9610
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD97A0 NtUnmapViewOfSection, 4_2_02FD97A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FDA770 NtOpenThread, 4_2_02FDA770
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9770 NtSetInformationFile, 4_2_02FD9770
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9760 NtOpenProcess, 4_2_02FD9760
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9730 NtQueryVirtualMemory, 4_2_02FD9730
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FDA710 NtOpenProcessToken, 4_2_02FDA710
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD95F0 NtQueryInformationFile, 4_2_02FD95F0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9560 NtWriteFile, 4_2_02FD9560
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FDAD30 NtSetContextThread, 4_2_02FDAD30
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD9520 NtWaitForSingleObject, 4_2_02FD9520
Contains functionality to communicate with device drivers
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B6550: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z, 4_2_002B6550
Contains functionality to launch a process as a different user
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B374E InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,lstrcmpW,CreateProcessW,CloseHandle,GetLastError,GetLastError,DeleteProcThreadAttributeList,_local_unwind4,CreateProcessAsUserW,GetLastError,CloseHandle, 4_2_002B374E
Detected potential crypto function
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D8D8C9 0_2_00D8D8C9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D8A8F1 0_2_00D8A8F1
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D96060 0_2_00D96060
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D95580 0_2_00D95580
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D9515C 0_2_00D9515C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D97931 0_2_00D97931
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D95AF0 0_2_00D95AF0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D967DC 0_2_00D967DC
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D903D2 0_2_00D903D2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041D87D 2_2_0041D87D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041D985 2_2_0041D985
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041DA2B 2_2_0041DA2B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041D408 2_2_0041D408
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041DCF9 2_2_0041DCF9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041D52D 2_2_0041D52D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00402D87 2_2_00402D87
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00409E30 2_2_00409E30
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041E745 2_2_0041E745
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041DFC5 2_2_0041DFC5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041CF93 2_2_0041CF93
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D8D8C9 2_2_00D8D8C9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D8A8F1 2_2_00D8A8F1
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D96060 2_2_00D96060
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D9515C 2_2_00D9515C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D97931 2_2_00D97931
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D95AF0 2_2_00D95AF0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D903D2 2_2_00D903D2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D95580 2_2_00D95580
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D967DC 2_2_00D967DC
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FF900 2_2_014FF900
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01514120 2_2_01514120
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1002 2_2_015B1002
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015CE824 2_2_015CE824
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C28EC 2_2_015C28EC
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150B090 2_2_0150B090
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015220A0 2_2_015220A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C20A8 2_2_015C20A8
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C2B28 2_2_015C2B28
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BDBD2 2_2_015BDBD2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152EBB0 2_2_0152EBB0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C22AE 2_2_015C22AE
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C1D55 2_2_015C1D55
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C2D07 2_2_015C2D07
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F0D20 2_2_014F0D20
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C25DD 2_2_015C25DD
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150D5E0 2_2_0150D5E0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522581 2_2_01522581
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BD466 2_2_015BD466
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150841F 2_2_0150841F
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C1FF1 2_2_015C1FF1
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BD616 2_2_015BD616
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01516E30 2_2_01516E30
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C2EF7 2_2_015C2EF7
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AD803 4_2_002AD803
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AE040 4_2_002AE040
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002C5CEA 4_2_002C5CEA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A48E6 4_2_002A48E6
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A9CF0 4_2_002A9CF0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002C3506 4_2_002C3506
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B1969 4_2_002B1969
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B6550 4_2_002B6550
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A7190 4_2_002A7190
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002C31DC 4_2_002C31DC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A5226 4_2_002A5226
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AFA30 4_2_002AFA30
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A5E70 4_2_002A5E70
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A8AD7 4_2_002A8AD7
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002ACB48 4_2_002ACB48
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002C6FF0 4_2_002C6FF0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B5FC8 4_2_002B5FC8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03062B28 4_2_03062B28
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305DBD2 4_2_0305DBD2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030503DA 4_2_030503DA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0304FA2B 4_2_0304FA2B
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCEBB0 4_2_02FCEBB0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030622AE 4_2_030622AE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBAB40 4_2_02FBAB40
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC20A0 4_2_02FC20A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAB090 4_2_02FAB090
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051002 4_2_03051002
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0306E824 4_2_0306E824
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030620A8 4_2_030620A8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB4120 4_2_02FB4120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030628EC 4_2_030628EC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9F900 4_2_02F9F900
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0306DFCE 4_2_0306DFCE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB6E30 4_2_02FB6E30
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03061FF1 4_2_03061FF1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305D616 4_2_0305D616
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03062EF7 4_2_03062EF7
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03062D07 4_2_03062D07
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03061D55 4_2_03061D55
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030625DD 4_2_030625DD
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA841F 4_2_02FA841F
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAD5E0 4_2_02FAD5E0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305D466 4_2_0305D466
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC2581 4_2_02FC2581
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F90D20 4_2_02F90D20
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: String function: 00D86E91 appears 84 times
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: String function: 00D86EA6 appears 36 times
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: String function: 00D86FC1 appears 40 times
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: String function: 00D89100 appears 64 times
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: String function: 014FB150 appears 35 times
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: String function: 00D870FC appears 370 times
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: String function: 00D8BF63 appears 38 times
Source: C:\Windows\SysWOW64\cmd.exe Code function: String function: 02F9B150 appears 45 times
Sample file is different than original file name gathered from version info
Source: RRW9901200241.exe, 00000000.00000002.341417567.0000000000FF0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemsvfw32.dll.muij% vs RRW9901200241.exe
Source: RRW9901200241.exe, 00000000.00000003.337793378.000000001B18F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs RRW9901200241.exe
Source: RRW9901200241.exe, 00000002.00000003.381525500.0000000001081000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameCmd.Exej% vs RRW9901200241.exe
Source: RRW9901200241.exe, 00000002.00000002.384345094.00000000015EF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs RRW9901200241.exe
Uses 32bit PE files
Source: RRW9901200241.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000002.00000002.383682726.0000000001030000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.383682726.0000000001030000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.341808975.0000000001A00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.341808975.0000000001A00000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.677144358.0000000000370000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.677144358.0000000000370000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.677857555.00000000027D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.677857555.00000000027D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.382481853.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.382481853.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.383234162.0000000001000000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.383234162.0000000001000000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.RRW9901200241.exe.1a00000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.RRW9901200241.exe.1a00000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.RRW9901200241.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.RRW9901200241.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.RRW9901200241.exe.1a00000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.RRW9901200241.exe.1a00000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.RRW9901200241.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.RRW9901200241.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/0@6/4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AC5CA _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,GetLastError,GetLastError,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,EnterCriticalSection,LeaveCriticalSection,exit, 4_2_002AC5CA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002CA0D2 memset,GetDiskFreeSpaceExW,??_V@YAXPAX@Z, 4_2_002CA0D2
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6536:120:WilError_01
Source: C:\Users\user\Desktop\RRW9901200241.exe Command line argument: Kernel32.dll 0_2_00D81000
Source: C:\Users\user\Desktop\RRW9901200241.exe Command line argument: User32.dll 0_2_00D81000
Source: C:\Users\user\Desktop\RRW9901200241.exe Command line argument: User32.dll 0_2_00D81000
Source: C:\Users\user\Desktop\RRW9901200241.exe Command line argument: IEUCIZEO 0_2_00D81000
Source: C:\Users\user\Desktop\RRW9901200241.exe Command line argument: Kernel32.dll 2_2_00D81000
Source: C:\Users\user\Desktop\RRW9901200241.exe Command line argument: User32.dll 2_2_00D81000
Source: C:\Users\user\Desktop\RRW9901200241.exe Command line argument: User32.dll 2_2_00D81000
Source: C:\Users\user\Desktop\RRW9901200241.exe Command line argument: IEUCIZEO 2_2_00D81000
Source: RRW9901200241.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\RRW9901200241.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: RRW9901200241.exe ReversingLabs: Detection: 34%
Source: C:\Users\user\Desktop\RRW9901200241.exe File read: C:\Users\user\Desktop\RRW9901200241.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\RRW9901200241.exe 'C:\Users\user\Desktop\RRW9901200241.exe'
Source: unknown Process created: C:\Users\user\Desktop\RRW9901200241.exe 'C:\Users\user\Desktop\RRW9901200241.exe'
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: unknown Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RRW9901200241.exe'
Source: unknown Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RRW9901200241.exe Process created: C:\Users\user\Desktop\RRW9901200241.exe 'C:\Users\user\Desktop\RRW9901200241.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RRW9901200241.exe' Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32 Jump to behavior
Source: RRW9901200241.exe Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000003.00000000.363251700.0000000007CA0000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: RRW9901200241.exe, 00000000.00000003.337251978.000000001B070000.00000004.00000001.sdmp, RRW9901200241.exe, 00000002.00000002.384345094.00000000015EF000.00000040.00000001.sdmp, cmd.exe, 00000004.00000002.678905716.000000000308F000.00000040.00000001.sdmp
Source: Binary string: cmd.pdbUGP source: RRW9901200241.exe, 00000002.00000003.381525500.0000000001081000.00000004.00000001.sdmp, cmd.exe, 00000004.00000002.676959985.00000000002A0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: RRW9901200241.exe, cmd.exe
Source: Binary string: cmd.pdb source: RRW9901200241.exe, 00000002.00000003.381525500.0000000001081000.00000004.00000001.sdmp, cmd.exe
Source: Binary string: wscui.pdb source: explorer.exe, 00000003.00000000.363251700.0000000007CA0000.00000002.00000001.sdmp
Source: RRW9901200241.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: RRW9901200241.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: RRW9901200241.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: RRW9901200241.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: RRW9901200241.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D91AB3 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_00D91AB3
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D89145 push ecx; ret 0_2_00D89158
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_012FFC06 pushad ; retf 0_2_012FFC25
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041E3CF push ds; ret 2_2_0041E3D3
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00417CE0 push 403FCDEBh; iretd 2_2_00417D3A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00417CB6 push 403FCDEBh; iretd 2_2_00417D3A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041CEF2 push eax; ret 2_2_0041CEF8
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041CEFB push eax; ret 2_2_0041CF62
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041CEA5 push eax; ret 2_2_0041CEF8
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0041CF5C push eax; ret 2_2_0041CF62
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00414F86 push edi; ret 2_2_00414F88
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D89145 push ecx; ret 2_2_00D89158
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0154D0D1 push ecx; ret 2_2_0154D0E4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B76BD push ecx; ret 4_2_002B76D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B76D1 push ecx; ret 4_2_002B76E4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FED0D1 push ecx; ret 4_2_02FED0E4

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8E 0xEE 0xE5
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\RRW9901200241.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RRW9901200241.exe RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe RDTSC instruction interceptor: First address: 00000000027D98E4 second address: 00000000027D98EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe RDTSC instruction interceptor: First address: 00000000027D9B4E second address: 00000000027D9B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00409A80 rdtsc 2_2_00409A80
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 1040 Thread sleep count: 49 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 1040 Thread sleep time: -98000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe TID: 4868 Thread sleep time: -100000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B245C FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove, 4_2_002B245C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B68BA FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose, 4_2_002B68BA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002AB89C GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose, 4_2_002AB89C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A85EA memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW, 4_2_002A85EA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002C31DC FindFirstFileW,FindNextFileW,FindClose, 4_2_002C31DC
Source: explorer.exe, 00000003.00000000.364943349.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000003.00000000.364891332.00000000083E8000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000003.00000000.368126601.0000000008662000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000002.690932206.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.357665667.00000000062E0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.364891332.00000000083E8000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000000.357665667.00000000062E0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000002.691817008.00000000062E0000.00000004.00000001.sdmp Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllte
Source: explorer.exe, 00000003.00000000.364593921.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000003.00000002.690932206.0000000005D50000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000002.690932206.0000000005D50000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.364593921.00000000082E2000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000003.00000000.364943349.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000003.00000002.690932206.0000000005D50000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000003.00000000.346593091.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: C:\Users\user\Desktop\RRW9901200241.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\RRW9901200241.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00409A80 rdtsc 2_2_00409A80
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0040ACC0 LdrLoadDll, 2_2_0040ACC0
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D889BC _memset,IsDebuggerPresent, 0_2_00D889BC
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D91AB3 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_00D91AB3
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D91AB3 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_00D91AB3
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D869A0 mov eax, dword ptr fs:[00000030h] 0_2_00D869A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_012FED06 mov eax, dword ptr fs:[00000030h] 0_2_012FED06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_012FF575 mov eax, dword ptr fs:[00000030h] 0_2_012FF575
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_012FF5B2 mov eax, dword ptr fs:[00000030h] 0_2_012FF5B2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_012FF75D mov eax, dword ptr fs:[00000030h] 0_2_012FF75D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_012FF615 mov eax, dword ptr fs:[00000030h] 0_2_012FF615
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D869A0 mov eax, dword ptr fs:[00000030h] 2_2_00D869A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151B944 mov eax, dword ptr fs:[00000030h] 2_2_0151B944
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151B944 mov eax, dword ptr fs:[00000030h] 2_2_0151B944
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FC962 mov eax, dword ptr fs:[00000030h] 2_2_014FC962
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FB171 mov eax, dword ptr fs:[00000030h] 2_2_014FB171
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FB171 mov eax, dword ptr fs:[00000030h] 2_2_014FB171
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F9100 mov eax, dword ptr fs:[00000030h] 2_2_014F9100
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F9100 mov eax, dword ptr fs:[00000030h] 2_2_014F9100
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F9100 mov eax, dword ptr fs:[00000030h] 2_2_014F9100
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152513A mov eax, dword ptr fs:[00000030h] 2_2_0152513A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152513A mov eax, dword ptr fs:[00000030h] 2_2_0152513A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01514120 mov eax, dword ptr fs:[00000030h] 2_2_01514120
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01514120 mov eax, dword ptr fs:[00000030h] 2_2_01514120
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01514120 mov eax, dword ptr fs:[00000030h] 2_2_01514120
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01514120 mov eax, dword ptr fs:[00000030h] 2_2_01514120
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01514120 mov ecx, dword ptr fs:[00000030h] 2_2_01514120
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FB1E1 mov eax, dword ptr fs:[00000030h] 2_2_014FB1E1
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FB1E1 mov eax, dword ptr fs:[00000030h] 2_2_014FB1E1
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FB1E1 mov eax, dword ptr fs:[00000030h] 2_2_014FB1E1
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015841E8 mov eax, dword ptr fs:[00000030h] 2_2_015841E8
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522990 mov eax, dword ptr fs:[00000030h] 2_2_01522990
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151C182 mov eax, dword ptr fs:[00000030h] 2_2_0151C182
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152A185 mov eax, dword ptr fs:[00000030h] 2_2_0152A185
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015751BE mov eax, dword ptr fs:[00000030h] 2_2_015751BE
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015751BE mov eax, dword ptr fs:[00000030h] 2_2_015751BE
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015751BE mov eax, dword ptr fs:[00000030h] 2_2_015751BE
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015751BE mov eax, dword ptr fs:[00000030h] 2_2_015751BE
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015769A6 mov eax, dword ptr fs:[00000030h] 2_2_015769A6
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015261A0 mov eax, dword ptr fs:[00000030h] 2_2_015261A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015261A0 mov eax, dword ptr fs:[00000030h] 2_2_015261A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01510050 mov eax, dword ptr fs:[00000030h] 2_2_01510050
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01510050 mov eax, dword ptr fs:[00000030h] 2_2_01510050
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B2073 mov eax, dword ptr fs:[00000030h] 2_2_015B2073
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C1074 mov eax, dword ptr fs:[00000030h] 2_2_015C1074
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01577016 mov eax, dword ptr fs:[00000030h] 2_2_01577016
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01577016 mov eax, dword ptr fs:[00000030h] 2_2_01577016
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01577016 mov eax, dword ptr fs:[00000030h] 2_2_01577016
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C4015 mov eax, dword ptr fs:[00000030h] 2_2_015C4015
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C4015 mov eax, dword ptr fs:[00000030h] 2_2_015C4015
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150B02A mov eax, dword ptr fs:[00000030h] 2_2_0150B02A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150B02A mov eax, dword ptr fs:[00000030h] 2_2_0150B02A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150B02A mov eax, dword ptr fs:[00000030h] 2_2_0150B02A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150B02A mov eax, dword ptr fs:[00000030h] 2_2_0150B02A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152002D mov eax, dword ptr fs:[00000030h] 2_2_0152002D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152002D mov eax, dword ptr fs:[00000030h] 2_2_0152002D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152002D mov eax, dword ptr fs:[00000030h] 2_2_0152002D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152002D mov eax, dword ptr fs:[00000030h] 2_2_0152002D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152002D mov eax, dword ptr fs:[00000030h] 2_2_0152002D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0158B8D0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158B8D0 mov ecx, dword ptr fs:[00000030h] 2_2_0158B8D0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0158B8D0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0158B8D0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0158B8D0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158B8D0 mov eax, dword ptr fs:[00000030h] 2_2_0158B8D0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F58EC mov eax, dword ptr fs:[00000030h] 2_2_014F58EC
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F9080 mov eax, dword ptr fs:[00000030h] 2_2_014F9080
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01573884 mov eax, dword ptr fs:[00000030h] 2_2_01573884
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01573884 mov eax, dword ptr fs:[00000030h] 2_2_01573884
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152F0BF mov ecx, dword ptr fs:[00000030h] 2_2_0152F0BF
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152F0BF mov eax, dword ptr fs:[00000030h] 2_2_0152F0BF
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152F0BF mov eax, dword ptr fs:[00000030h] 2_2_0152F0BF
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015220A0 mov eax, dword ptr fs:[00000030h] 2_2_015220A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015220A0 mov eax, dword ptr fs:[00000030h] 2_2_015220A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015220A0 mov eax, dword ptr fs:[00000030h] 2_2_015220A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015220A0 mov eax, dword ptr fs:[00000030h] 2_2_015220A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015220A0 mov eax, dword ptr fs:[00000030h] 2_2_015220A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015220A0 mov eax, dword ptr fs:[00000030h] 2_2_015220A0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015390AF mov eax, dword ptr fs:[00000030h] 2_2_015390AF
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C8B58 mov eax, dword ptr fs:[00000030h] 2_2_015C8B58
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FDB40 mov eax, dword ptr fs:[00000030h] 2_2_014FDB40
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FF358 mov eax, dword ptr fs:[00000030h] 2_2_014FF358
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01523B7A mov eax, dword ptr fs:[00000030h] 2_2_01523B7A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01523B7A mov eax, dword ptr fs:[00000030h] 2_2_01523B7A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FDB60 mov ecx, dword ptr fs:[00000030h] 2_2_014FDB60
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B131B mov eax, dword ptr fs:[00000030h] 2_2_015B131B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015753CA mov eax, dword ptr fs:[00000030h] 2_2_015753CA
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015753CA mov eax, dword ptr fs:[00000030h] 2_2_015753CA
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015203E2 mov eax, dword ptr fs:[00000030h] 2_2_015203E2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015203E2 mov eax, dword ptr fs:[00000030h] 2_2_015203E2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015203E2 mov eax, dword ptr fs:[00000030h] 2_2_015203E2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015203E2 mov eax, dword ptr fs:[00000030h] 2_2_015203E2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015203E2 mov eax, dword ptr fs:[00000030h] 2_2_015203E2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015203E2 mov eax, dword ptr fs:[00000030h] 2_2_015203E2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151DBE9 mov eax, dword ptr fs:[00000030h] 2_2_0151DBE9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152B390 mov eax, dword ptr fs:[00000030h] 2_2_0152B390
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522397 mov eax, dword ptr fs:[00000030h] 2_2_01522397
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B138A mov eax, dword ptr fs:[00000030h] 2_2_015B138A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015AD380 mov ecx, dword ptr fs:[00000030h] 2_2_015AD380
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01501B8F mov eax, dword ptr fs:[00000030h] 2_2_01501B8F
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01501B8F mov eax, dword ptr fs:[00000030h] 2_2_01501B8F
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C5BA5 mov eax, dword ptr fs:[00000030h] 2_2_015C5BA5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01524BAD mov eax, dword ptr fs:[00000030h] 2_2_01524BAD
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01524BAD mov eax, dword ptr fs:[00000030h] 2_2_01524BAD
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01524BAD mov eax, dword ptr fs:[00000030h] 2_2_01524BAD
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BEA55 mov eax, dword ptr fs:[00000030h] 2_2_015BEA55
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F9240 mov eax, dword ptr fs:[00000030h] 2_2_014F9240
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F9240 mov eax, dword ptr fs:[00000030h] 2_2_014F9240
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F9240 mov eax, dword ptr fs:[00000030h] 2_2_014F9240
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F9240 mov eax, dword ptr fs:[00000030h] 2_2_014F9240
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01584257 mov eax, dword ptr fs:[00000030h] 2_2_01584257
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0153927A mov eax, dword ptr fs:[00000030h] 2_2_0153927A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015AB260 mov eax, dword ptr fs:[00000030h] 2_2_015AB260
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015AB260 mov eax, dword ptr fs:[00000030h] 2_2_015AB260
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C8A62 mov eax, dword ptr fs:[00000030h] 2_2_015C8A62
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01513A1C mov eax, dword ptr fs:[00000030h] 2_2_01513A1C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BAA16 mov eax, dword ptr fs:[00000030h] 2_2_015BAA16
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BAA16 mov eax, dword ptr fs:[00000030h] 2_2_015BAA16
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FAA16 mov eax, dword ptr fs:[00000030h] 2_2_014FAA16
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FAA16 mov eax, dword ptr fs:[00000030h] 2_2_014FAA16
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01508A0A mov eax, dword ptr fs:[00000030h] 2_2_01508A0A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F5210 mov eax, dword ptr fs:[00000030h] 2_2_014F5210
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F5210 mov ecx, dword ptr fs:[00000030h] 2_2_014F5210
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F5210 mov eax, dword ptr fs:[00000030h] 2_2_014F5210
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F5210 mov eax, dword ptr fs:[00000030h] 2_2_014F5210
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01534A2C mov eax, dword ptr fs:[00000030h] 2_2_01534A2C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01534A2C mov eax, dword ptr fs:[00000030h] 2_2_01534A2C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522ACB mov eax, dword ptr fs:[00000030h] 2_2_01522ACB
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522AE4 mov eax, dword ptr fs:[00000030h] 2_2_01522AE4
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152D294 mov eax, dword ptr fs:[00000030h] 2_2_0152D294
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152D294 mov eax, dword ptr fs:[00000030h] 2_2_0152D294
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150AAB0 mov eax, dword ptr fs:[00000030h] 2_2_0150AAB0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150AAB0 mov eax, dword ptr fs:[00000030h] 2_2_0150AAB0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152FAB0 mov eax, dword ptr fs:[00000030h] 2_2_0152FAB0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F52A5 mov eax, dword ptr fs:[00000030h] 2_2_014F52A5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F52A5 mov eax, dword ptr fs:[00000030h] 2_2_014F52A5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F52A5 mov eax, dword ptr fs:[00000030h] 2_2_014F52A5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F52A5 mov eax, dword ptr fs:[00000030h] 2_2_014F52A5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F52A5 mov eax, dword ptr fs:[00000030h] 2_2_014F52A5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01517D50 mov eax, dword ptr fs:[00000030h] 2_2_01517D50
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01533D43 mov eax, dword ptr fs:[00000030h] 2_2_01533D43
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01573540 mov eax, dword ptr fs:[00000030h] 2_2_01573540
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151C577 mov eax, dword ptr fs:[00000030h] 2_2_0151C577
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151C577 mov eax, dword ptr fs:[00000030h] 2_2_0151C577
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0157A537 mov eax, dword ptr fs:[00000030h] 2_2_0157A537
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BE539 mov eax, dword ptr fs:[00000030h] 2_2_015BE539
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01503D34 mov eax, dword ptr fs:[00000030h] 2_2_01503D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C8D34 mov eax, dword ptr fs:[00000030h] 2_2_015C8D34
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01524D3B mov eax, dword ptr fs:[00000030h] 2_2_01524D3B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01524D3B mov eax, dword ptr fs:[00000030h] 2_2_01524D3B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01524D3B mov eax, dword ptr fs:[00000030h] 2_2_01524D3B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FAD30 mov eax, dword ptr fs:[00000030h] 2_2_014FAD30
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576DC9 mov eax, dword ptr fs:[00000030h] 2_2_01576DC9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576DC9 mov eax, dword ptr fs:[00000030h] 2_2_01576DC9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576DC9 mov eax, dword ptr fs:[00000030h] 2_2_01576DC9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576DC9 mov ecx, dword ptr fs:[00000030h] 2_2_01576DC9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576DC9 mov eax, dword ptr fs:[00000030h] 2_2_01576DC9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576DC9 mov eax, dword ptr fs:[00000030h] 2_2_01576DC9
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015A8DF1 mov eax, dword ptr fs:[00000030h] 2_2_015A8DF1
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150D5E0 mov eax, dword ptr fs:[00000030h] 2_2_0150D5E0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150D5E0 mov eax, dword ptr fs:[00000030h] 2_2_0150D5E0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BFDE2 mov eax, dword ptr fs:[00000030h] 2_2_015BFDE2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BFDE2 mov eax, dword ptr fs:[00000030h] 2_2_015BFDE2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BFDE2 mov eax, dword ptr fs:[00000030h] 2_2_015BFDE2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BFDE2 mov eax, dword ptr fs:[00000030h] 2_2_015BFDE2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F2D8A mov eax, dword ptr fs:[00000030h] 2_2_014F2D8A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F2D8A mov eax, dword ptr fs:[00000030h] 2_2_014F2D8A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F2D8A mov eax, dword ptr fs:[00000030h] 2_2_014F2D8A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F2D8A mov eax, dword ptr fs:[00000030h] 2_2_014F2D8A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F2D8A mov eax, dword ptr fs:[00000030h] 2_2_014F2D8A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152FD9B mov eax, dword ptr fs:[00000030h] 2_2_0152FD9B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152FD9B mov eax, dword ptr fs:[00000030h] 2_2_0152FD9B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522581 mov eax, dword ptr fs:[00000030h] 2_2_01522581
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522581 mov eax, dword ptr fs:[00000030h] 2_2_01522581
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522581 mov eax, dword ptr fs:[00000030h] 2_2_01522581
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01522581 mov eax, dword ptr fs:[00000030h] 2_2_01522581
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01521DB5 mov eax, dword ptr fs:[00000030h] 2_2_01521DB5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01521DB5 mov eax, dword ptr fs:[00000030h] 2_2_01521DB5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01521DB5 mov eax, dword ptr fs:[00000030h] 2_2_01521DB5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C05AC mov eax, dword ptr fs:[00000030h] 2_2_015C05AC
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C05AC mov eax, dword ptr fs:[00000030h] 2_2_015C05AC
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015235A1 mov eax, dword ptr fs:[00000030h] 2_2_015235A1
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158C450 mov eax, dword ptr fs:[00000030h] 2_2_0158C450
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158C450 mov eax, dword ptr fs:[00000030h] 2_2_0158C450
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152A44B mov eax, dword ptr fs:[00000030h] 2_2_0152A44B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151746D mov eax, dword ptr fs:[00000030h] 2_2_0151746D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C740D mov eax, dword ptr fs:[00000030h] 2_2_015C740D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C740D mov eax, dword ptr fs:[00000030h] 2_2_015C740D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C740D mov eax, dword ptr fs:[00000030h] 2_2_015C740D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1C06 mov eax, dword ptr fs:[00000030h] 2_2_015B1C06
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576C0A mov eax, dword ptr fs:[00000030h] 2_2_01576C0A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576C0A mov eax, dword ptr fs:[00000030h] 2_2_01576C0A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576C0A mov eax, dword ptr fs:[00000030h] 2_2_01576C0A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576C0A mov eax, dword ptr fs:[00000030h] 2_2_01576C0A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152BC2C mov eax, dword ptr fs:[00000030h] 2_2_0152BC2C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C8CD6 mov eax, dword ptr fs:[00000030h] 2_2_015C8CD6
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B14FB mov eax, dword ptr fs:[00000030h] 2_2_015B14FB
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576CF0 mov eax, dword ptr fs:[00000030h] 2_2_01576CF0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576CF0 mov eax, dword ptr fs:[00000030h] 2_2_01576CF0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01576CF0 mov eax, dword ptr fs:[00000030h] 2_2_01576CF0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150849B mov eax, dword ptr fs:[00000030h] 2_2_0150849B
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150EF40 mov eax, dword ptr fs:[00000030h] 2_2_0150EF40
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150FF60 mov eax, dword ptr fs:[00000030h] 2_2_0150FF60
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C8F6A mov eax, dword ptr fs:[00000030h] 2_2_015C8F6A
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151F716 mov eax, dword ptr fs:[00000030h] 2_2_0151F716
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158FF10 mov eax, dword ptr fs:[00000030h] 2_2_0158FF10
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158FF10 mov eax, dword ptr fs:[00000030h] 2_2_0158FF10
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C070D mov eax, dword ptr fs:[00000030h] 2_2_015C070D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C070D mov eax, dword ptr fs:[00000030h] 2_2_015C070D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152A70E mov eax, dword ptr fs:[00000030h] 2_2_0152A70E
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152A70E mov eax, dword ptr fs:[00000030h] 2_2_0152A70E
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F4F2E mov eax, dword ptr fs:[00000030h] 2_2_014F4F2E
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014F4F2E mov eax, dword ptr fs:[00000030h] 2_2_014F4F2E
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152E730 mov eax, dword ptr fs:[00000030h] 2_2_0152E730
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015337F5 mov eax, dword ptr fs:[00000030h] 2_2_015337F5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01577794 mov eax, dword ptr fs:[00000030h] 2_2_01577794
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01577794 mov eax, dword ptr fs:[00000030h] 2_2_01577794
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01577794 mov eax, dword ptr fs:[00000030h] 2_2_01577794
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01508794 mov eax, dword ptr fs:[00000030h] 2_2_01508794
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01507E41 mov eax, dword ptr fs:[00000030h] 2_2_01507E41
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01507E41 mov eax, dword ptr fs:[00000030h] 2_2_01507E41
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01507E41 mov eax, dword ptr fs:[00000030h] 2_2_01507E41
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01507E41 mov eax, dword ptr fs:[00000030h] 2_2_01507E41
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01507E41 mov eax, dword ptr fs:[00000030h] 2_2_01507E41
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01507E41 mov eax, dword ptr fs:[00000030h] 2_2_01507E41
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BAE44 mov eax, dword ptr fs:[00000030h] 2_2_015BAE44
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015BAE44 mov eax, dword ptr fs:[00000030h] 2_2_015BAE44
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151AE73 mov eax, dword ptr fs:[00000030h] 2_2_0151AE73
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151AE73 mov eax, dword ptr fs:[00000030h] 2_2_0151AE73
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151AE73 mov eax, dword ptr fs:[00000030h] 2_2_0151AE73
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151AE73 mov eax, dword ptr fs:[00000030h] 2_2_0151AE73
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0151AE73 mov eax, dword ptr fs:[00000030h] 2_2_0151AE73
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0150766D mov eax, dword ptr fs:[00000030h] 2_2_0150766D
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152A61C mov eax, dword ptr fs:[00000030h] 2_2_0152A61C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0152A61C mov eax, dword ptr fs:[00000030h] 2_2_0152A61C
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FC600 mov eax, dword ptr fs:[00000030h] 2_2_014FC600
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FC600 mov eax, dword ptr fs:[00000030h] 2_2_014FC600
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FC600 mov eax, dword ptr fs:[00000030h] 2_2_014FC600
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01528E00 mov eax, dword ptr fs:[00000030h] 2_2_01528E00
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015B1608 mov eax, dword ptr fs:[00000030h] 2_2_015B1608
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015AFE3F mov eax, dword ptr fs:[00000030h] 2_2_015AFE3F
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_014FE620 mov eax, dword ptr fs:[00000030h] 2_2_014FE620
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C8ED6 mov eax, dword ptr fs:[00000030h] 2_2_015C8ED6
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_01538EC7 mov eax, dword ptr fs:[00000030h] 2_2_01538EC7
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015AFEC0 mov eax, dword ptr fs:[00000030h] 2_2_015AFEC0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015236CC mov eax, dword ptr fs:[00000030h] 2_2_015236CC
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015216E0 mov ecx, dword ptr fs:[00000030h] 2_2_015216E0
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015076E2 mov eax, dword ptr fs:[00000030h] 2_2_015076E2
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_0158FE87 mov eax, dword ptr fs:[00000030h] 2_2_0158FE87
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015746A7 mov eax, dword ptr fs:[00000030h] 2_2_015746A7
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C0EA5 mov eax, dword ptr fs:[00000030h] 2_2_015C0EA5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C0EA5 mov eax, dword ptr fs:[00000030h] 2_2_015C0EA5
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_015C0EA5 mov eax, dword ptr fs:[00000030h] 2_2_015C0EA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002CB5E0 mov eax, dword ptr fs:[00000030h] 4_2_002CB5E0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC2AE4 mov eax, dword ptr fs:[00000030h] 4_2_02FC2AE4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305131B mov eax, dword ptr fs:[00000030h] 4_2_0305131B
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC2ACB mov eax, dword ptr fs:[00000030h] 4_2_02FC2ACB
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAAAB0 mov eax, dword ptr fs:[00000030h] 4_2_02FAAAB0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAAAB0 mov eax, dword ptr fs:[00000030h] 4_2_02FAAAB0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCFAB0 mov eax, dword ptr fs:[00000030h] 4_2_02FCFAB0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F952A5 mov eax, dword ptr fs:[00000030h] 4_2_02F952A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F952A5 mov eax, dword ptr fs:[00000030h] 4_2_02F952A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F952A5 mov eax, dword ptr fs:[00000030h] 4_2_02F952A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F952A5 mov eax, dword ptr fs:[00000030h] 4_2_02F952A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F952A5 mov eax, dword ptr fs:[00000030h] 4_2_02F952A5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03068B58 mov eax, dword ptr fs:[00000030h] 4_2_03068B58
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCD294 mov eax, dword ptr fs:[00000030h] 4_2_02FCD294
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCD294 mov eax, dword ptr fs:[00000030h] 4_2_02FCD294
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0304D380 mov ecx, dword ptr fs:[00000030h] 4_2_0304D380
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD927A mov eax, dword ptr fs:[00000030h] 4_2_02FD927A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305138A mov eax, dword ptr fs:[00000030h] 4_2_0305138A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03065BA5 mov eax, dword ptr fs:[00000030h] 4_2_03065BA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F99240 mov eax, dword ptr fs:[00000030h] 4_2_02F99240
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F99240 mov eax, dword ptr fs:[00000030h] 4_2_02F99240
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F99240 mov eax, dword ptr fs:[00000030h] 4_2_02F99240
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F99240 mov eax, dword ptr fs:[00000030h] 4_2_02F99240
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030153CA mov eax, dword ptr fs:[00000030h] 4_2_030153CA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030153CA mov eax, dword ptr fs:[00000030h] 4_2_030153CA
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD4A2C mov eax, dword ptr fs:[00000030h] 4_2_02FD4A2C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD4A2C mov eax, dword ptr fs:[00000030h] 4_2_02FD4A2C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB3A1C mov eax, dword ptr fs:[00000030h] 4_2_02FB3A1C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F95210 mov eax, dword ptr fs:[00000030h] 4_2_02F95210
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F95210 mov ecx, dword ptr fs:[00000030h] 4_2_02F95210
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F95210 mov eax, dword ptr fs:[00000030h] 4_2_02F95210
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F95210 mov eax, dword ptr fs:[00000030h] 4_2_02F95210
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9AA16 mov eax, dword ptr fs:[00000030h] 4_2_02F9AA16
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9AA16 mov eax, dword ptr fs:[00000030h] 4_2_02F9AA16
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA8A0A mov eax, dword ptr fs:[00000030h] 4_2_02FA8A0A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBDBE9 mov eax, dword ptr fs:[00000030h] 4_2_02FBDBE9
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305AA16 mov eax, dword ptr fs:[00000030h] 4_2_0305AA16
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305AA16 mov eax, dword ptr fs:[00000030h] 4_2_0305AA16
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC03E2 mov eax, dword ptr fs:[00000030h] 4_2_02FC03E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC03E2 mov eax, dword ptr fs:[00000030h] 4_2_02FC03E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC03E2 mov eax, dword ptr fs:[00000030h] 4_2_02FC03E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC03E2 mov eax, dword ptr fs:[00000030h] 4_2_02FC03E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC03E2 mov eax, dword ptr fs:[00000030h] 4_2_02FC03E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC03E2 mov eax, dword ptr fs:[00000030h] 4_2_02FC03E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305EA55 mov eax, dword ptr fs:[00000030h] 4_2_0305EA55
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC4BAD mov eax, dword ptr fs:[00000030h] 4_2_02FC4BAD
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC4BAD mov eax, dword ptr fs:[00000030h] 4_2_02FC4BAD
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC4BAD mov eax, dword ptr fs:[00000030h] 4_2_02FC4BAD
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03024257 mov eax, dword ptr fs:[00000030h] 4_2_03024257
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0304B260 mov eax, dword ptr fs:[00000030h] 4_2_0304B260
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0304B260 mov eax, dword ptr fs:[00000030h] 4_2_0304B260
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03068A62 mov eax, dword ptr fs:[00000030h] 4_2_03068A62
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC2397 mov eax, dword ptr fs:[00000030h] 4_2_02FC2397
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCB390 mov eax, dword ptr fs:[00000030h] 4_2_02FCB390
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA1B8F mov eax, dword ptr fs:[00000030h] 4_2_02FA1B8F
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA1B8F mov eax, dword ptr fs:[00000030h] 4_2_02FA1B8F
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC3B7A mov eax, dword ptr fs:[00000030h] 4_2_02FC3B7A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC3B7A mov eax, dword ptr fs:[00000030h] 4_2_02FC3B7A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9DB60 mov ecx, dword ptr fs:[00000030h] 4_2_02F9DB60
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9F358 mov eax, dword ptr fs:[00000030h] 4_2_02F9F358
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9DB40 mov eax, dword ptr fs:[00000030h] 4_2_02F9DB40
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F958EC mov eax, dword ptr fs:[00000030h] 4_2_02F958EC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F940E1 mov eax, dword ptr fs:[00000030h] 4_2_02F940E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F940E1 mov eax, dword ptr fs:[00000030h] 4_2_02F940E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F940E1 mov eax, dword ptr fs:[00000030h] 4_2_02F940E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCF0BF mov ecx, dword ptr fs:[00000030h] 4_2_02FCF0BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCF0BF mov eax, dword ptr fs:[00000030h] 4_2_02FCF0BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCF0BF mov eax, dword ptr fs:[00000030h] 4_2_02FCF0BF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD90AF mov eax, dword ptr fs:[00000030h] 4_2_02FD90AF
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC20A0 mov eax, dword ptr fs:[00000030h] 4_2_02FC20A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC20A0 mov eax, dword ptr fs:[00000030h] 4_2_02FC20A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC20A0 mov eax, dword ptr fs:[00000030h] 4_2_02FC20A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC20A0 mov eax, dword ptr fs:[00000030h] 4_2_02FC20A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC20A0 mov eax, dword ptr fs:[00000030h] 4_2_02FC20A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC20A0 mov eax, dword ptr fs:[00000030h] 4_2_02FC20A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F99080 mov eax, dword ptr fs:[00000030h] 4_2_02F99080
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030549A4 mov eax, dword ptr fs:[00000030h] 4_2_030549A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030549A4 mov eax, dword ptr fs:[00000030h] 4_2_030549A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030549A4 mov eax, dword ptr fs:[00000030h] 4_2_030549A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030549A4 mov eax, dword ptr fs:[00000030h] 4_2_030549A4
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030169A6 mov eax, dword ptr fs:[00000030h] 4_2_030169A6
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB0050 mov eax, dword ptr fs:[00000030h] 4_2_02FB0050
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB0050 mov eax, dword ptr fs:[00000030h] 4_2_02FB0050
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030151BE mov eax, dword ptr fs:[00000030h] 4_2_030151BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030151BE mov eax, dword ptr fs:[00000030h] 4_2_030151BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030151BE mov eax, dword ptr fs:[00000030h] 4_2_030151BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030151BE mov eax, dword ptr fs:[00000030h] 4_2_030151BE
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAB02A mov eax, dword ptr fs:[00000030h] 4_2_02FAB02A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAB02A mov eax, dword ptr fs:[00000030h] 4_2_02FAB02A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAB02A mov eax, dword ptr fs:[00000030h] 4_2_02FAB02A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAB02A mov eax, dword ptr fs:[00000030h] 4_2_02FAB02A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC002D mov eax, dword ptr fs:[00000030h] 4_2_02FC002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC002D mov eax, dword ptr fs:[00000030h] 4_2_02FC002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC002D mov eax, dword ptr fs:[00000030h] 4_2_02FC002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC002D mov eax, dword ptr fs:[00000030h] 4_2_02FC002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC002D mov eax, dword ptr fs:[00000030h] 4_2_02FC002D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030241E8 mov eax, dword ptr fs:[00000030h] 4_2_030241E8
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03064015 mov eax, dword ptr fs:[00000030h] 4_2_03064015
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03064015 mov eax, dword ptr fs:[00000030h] 4_2_03064015
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03017016 mov eax, dword ptr fs:[00000030h] 4_2_03017016
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03017016 mov eax, dword ptr fs:[00000030h] 4_2_03017016
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03017016 mov eax, dword ptr fs:[00000030h] 4_2_03017016
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9B1E1 mov eax, dword ptr fs:[00000030h] 4_2_02F9B1E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9B1E1 mov eax, dword ptr fs:[00000030h] 4_2_02F9B1E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9B1E1 mov eax, dword ptr fs:[00000030h] 4_2_02F9B1E1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC61A0 mov eax, dword ptr fs:[00000030h] 4_2_02FC61A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC61A0 mov eax, dword ptr fs:[00000030h] 4_2_02FC61A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC2990 mov eax, dword ptr fs:[00000030h] 4_2_02FC2990
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03061074 mov eax, dword ptr fs:[00000030h] 4_2_03061074
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03052073 mov eax, dword ptr fs:[00000030h] 4_2_03052073
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBC182 mov eax, dword ptr fs:[00000030h] 4_2_02FBC182
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCA185 mov eax, dword ptr fs:[00000030h] 4_2_02FCA185
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03013884 mov eax, dword ptr fs:[00000030h] 4_2_03013884
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03013884 mov eax, dword ptr fs:[00000030h] 4_2_03013884
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9B171 mov eax, dword ptr fs:[00000030h] 4_2_02F9B171
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9B171 mov eax, dword ptr fs:[00000030h] 4_2_02F9B171
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9C962 mov eax, dword ptr fs:[00000030h] 4_2_02F9C962
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBB944 mov eax, dword ptr fs:[00000030h] 4_2_02FBB944
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBB944 mov eax, dword ptr fs:[00000030h] 4_2_02FBB944
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC513A mov eax, dword ptr fs:[00000030h] 4_2_02FC513A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC513A mov eax, dword ptr fs:[00000030h] 4_2_02FC513A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0302B8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302B8D0 mov ecx, dword ptr fs:[00000030h] 4_2_0302B8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0302B8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0302B8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0302B8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302B8D0 mov eax, dword ptr fs:[00000030h] 4_2_0302B8D0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB4120 mov eax, dword ptr fs:[00000030h] 4_2_02FB4120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB4120 mov eax, dword ptr fs:[00000030h] 4_2_02FB4120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB4120 mov eax, dword ptr fs:[00000030h] 4_2_02FB4120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB4120 mov eax, dword ptr fs:[00000030h] 4_2_02FB4120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB4120 mov ecx, dword ptr fs:[00000030h] 4_2_02FB4120
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F99100 mov eax, dword ptr fs:[00000030h] 4_2_02F99100
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F99100 mov eax, dword ptr fs:[00000030h] 4_2_02F99100
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F99100 mov eax, dword ptr fs:[00000030h] 4_2_02F99100
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0306070D mov eax, dword ptr fs:[00000030h] 4_2_0306070D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0306070D mov eax, dword ptr fs:[00000030h] 4_2_0306070D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302FF10 mov eax, dword ptr fs:[00000030h] 4_2_0302FF10
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302FF10 mov eax, dword ptr fs:[00000030h] 4_2_0302FF10
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA76E2 mov eax, dword ptr fs:[00000030h] 4_2_02FA76E2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC16E0 mov ecx, dword ptr fs:[00000030h] 4_2_02FC16E0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC36CC mov eax, dword ptr fs:[00000030h] 4_2_02FC36CC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD8EC7 mov eax, dword ptr fs:[00000030h] 4_2_02FD8EC7
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03068F6A mov eax, dword ptr fs:[00000030h] 4_2_03068F6A
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBAE73 mov eax, dword ptr fs:[00000030h] 4_2_02FBAE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBAE73 mov eax, dword ptr fs:[00000030h] 4_2_02FBAE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBAE73 mov eax, dword ptr fs:[00000030h] 4_2_02FBAE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBAE73 mov eax, dword ptr fs:[00000030h] 4_2_02FBAE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBAE73 mov eax, dword ptr fs:[00000030h] 4_2_02FBAE73
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03017794 mov eax, dword ptr fs:[00000030h] 4_2_03017794
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03017794 mov eax, dword ptr fs:[00000030h] 4_2_03017794
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03017794 mov eax, dword ptr fs:[00000030h] 4_2_03017794
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA766D mov eax, dword ptr fs:[00000030h] 4_2_02FA766D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA7E41 mov eax, dword ptr fs:[00000030h] 4_2_02FA7E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA7E41 mov eax, dword ptr fs:[00000030h] 4_2_02FA7E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA7E41 mov eax, dword ptr fs:[00000030h] 4_2_02FA7E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA7E41 mov eax, dword ptr fs:[00000030h] 4_2_02FA7E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA7E41 mov eax, dword ptr fs:[00000030h] 4_2_02FA7E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA7E41 mov eax, dword ptr fs:[00000030h] 4_2_02FA7E41
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9E620 mov eax, dword ptr fs:[00000030h] 4_2_02F9E620
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCA61C mov eax, dword ptr fs:[00000030h] 4_2_02FCA61C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCA61C mov eax, dword ptr fs:[00000030h] 4_2_02FCA61C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9C600 mov eax, dword ptr fs:[00000030h] 4_2_02F9C600
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9C600 mov eax, dword ptr fs:[00000030h] 4_2_02F9C600
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F9C600 mov eax, dword ptr fs:[00000030h] 4_2_02F9C600
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FC8E00 mov eax, dword ptr fs:[00000030h] 4_2_02FC8E00
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FD37F5 mov eax, dword ptr fs:[00000030h] 4_2_02FD37F5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051608 mov eax, dword ptr fs:[00000030h] 4_2_03051608
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0304FE3F mov eax, dword ptr fs:[00000030h] 4_2_0304FE3F
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305AE44 mov eax, dword ptr fs:[00000030h] 4_2_0305AE44
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305AE44 mov eax, dword ptr fs:[00000030h] 4_2_0305AE44
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA8794 mov eax, dword ptr fs:[00000030h] 4_2_02FA8794
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0302FE87 mov eax, dword ptr fs:[00000030h] 4_2_0302FE87
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAFF60 mov eax, dword ptr fs:[00000030h] 4_2_02FAFF60
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03060EA5 mov eax, dword ptr fs:[00000030h] 4_2_03060EA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03060EA5 mov eax, dword ptr fs:[00000030h] 4_2_03060EA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03060EA5 mov eax, dword ptr fs:[00000030h] 4_2_03060EA5
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030146A7 mov eax, dword ptr fs:[00000030h] 4_2_030146A7
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FAEF40 mov eax, dword ptr fs:[00000030h] 4_2_02FAEF40
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0304FEC0 mov eax, dword ptr fs:[00000030h] 4_2_0304FEC0
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCE730 mov eax, dword ptr fs:[00000030h] 4_2_02FCE730
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03068ED6 mov eax, dword ptr fs:[00000030h] 4_2_03068ED6
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F94F2E mov eax, dword ptr fs:[00000030h] 4_2_02F94F2E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02F94F2E mov eax, dword ptr fs:[00000030h] 4_2_02F94F2E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FBF716 mov eax, dword ptr fs:[00000030h] 4_2_02FBF716
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCA70E mov eax, dword ptr fs:[00000030h] 4_2_02FCA70E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCA70E mov eax, dword ptr fs:[00000030h] 4_2_02FCA70E
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03068D34 mov eax, dword ptr fs:[00000030h] 4_2_03068D34
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0301A537 mov eax, dword ptr fs:[00000030h] 4_2_0301A537
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305E539 mov eax, dword ptr fs:[00000030h] 4_2_0305E539
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03013540 mov eax, dword ptr fs:[00000030h] 4_2_03013540
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03043D40 mov eax, dword ptr fs:[00000030h] 4_2_03043D40
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FA849B mov eax, dword ptr fs:[00000030h] 4_2_02FA849B
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FB746D mov eax, dword ptr fs:[00000030h] 4_2_02FB746D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030605AC mov eax, dword ptr fs:[00000030h] 4_2_030605AC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_030605AC mov eax, dword ptr fs:[00000030h] 4_2_030605AC
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCA44B mov eax, dword ptr fs:[00000030h] 4_2_02FCA44B
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03016DC9 mov eax, dword ptr fs:[00000030h] 4_2_03016DC9
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03016DC9 mov eax, dword ptr fs:[00000030h] 4_2_03016DC9
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03016DC9 mov eax, dword ptr fs:[00000030h] 4_2_03016DC9
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03016DC9 mov ecx, dword ptr fs:[00000030h] 4_2_03016DC9
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03016DC9 mov eax, dword ptr fs:[00000030h] 4_2_03016DC9
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03016DC9 mov eax, dword ptr fs:[00000030h] 4_2_03016DC9
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_02FCBC2C mov eax, dword ptr fs:[00000030h] 4_2_02FCBC2C
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0305FDE2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0305FDE2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0305FDE2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0305FDE2 mov eax, dword ptr fs:[00000030h] 4_2_0305FDE2
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03048DF1 mov eax, dword ptr fs:[00000030h] 4_2_03048DF1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03051C06 mov eax, dword ptr fs:[00000030h] 4_2_03051C06
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0306740D mov eax, dword ptr fs:[00000030h] 4_2_0306740D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0306740D mov eax, dword ptr fs:[00000030h] 4_2_0306740D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_0306740D mov eax, dword ptr fs:[00000030h] 4_2_0306740D
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_03016C0A mov eax, dword ptr fs:[00000030h] 4_2_03016C0A
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D86B20 GetProcessHeap,RtlAllocateHeap,GetProcessHeap,HeapAlloc, 0_2_00D86B20
Enables debug privileges
Source: C:\Users\user\Desktop\RRW9901200241.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D8C043 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_00D8C043
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D8C020 SetUnhandledExceptionFilter, 0_2_00D8C020
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D8C043 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 2_2_00D8C043
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 2_2_00D8C020 SetUnhandledExceptionFilter, 2_2_00D8C020
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B7310 SetUnhandledExceptionFilter, 4_2_002B7310
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002B6FE3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 4_2_002B6FE3

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 161.35.25.247 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 18.209.115.26 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 112.213.89.130 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\RRW9901200241.exe Section loaded: unknown target: C:\Users\user\Desktop\RRW9901200241.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\RRW9901200241.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\RRW9901200241.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\RRW9901200241.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\RRW9901200241.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Thread register set: target process: 3440 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\RRW9901200241.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\RRW9901200241.exe Section unmapped: C:\Windows\SysWOW64\cmd.exe base address: 2A0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\RRW9901200241.exe Process created: C:\Users\user\Desktop\RRW9901200241.exe 'C:\Users\user\Desktop\RRW9901200241.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RRW9901200241.exe' Jump to behavior
Source: explorer.exe, 00000003.00000000.355976618.0000000004F80000.00000004.00000001.sdmp, cmd.exe, 00000004.00000002.679931331.00000000044A0000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.346483863.00000000008B8000.00000004.00000020.sdmp, cmd.exe, 00000004.00000002.679931331.00000000044A0000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.346897457.0000000000EE0000.00000002.00000001.sdmp, cmd.exe, 00000004.00000002.679931331.00000000044A0000.00000002.00000001.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000003.00000000.346897457.0000000000EE0000.00000002.00000001.sdmp, cmd.exe, 00000004.00000002.679931331.00000000044A0000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D8D757 cpuid 0_2_00D8D757
Contains functionality to query locales information (e.g. system language)
Source: C:\Windows\SysWOW64\cmd.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW, 4_2_002A96A0
Source: C:\Windows\SysWOW64\cmd.exe Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc, 4_2_002A5AEF
Source: C:\Windows\SysWOW64\cmd.exe Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale, 4_2_002B3F80
Source: C:\Users\user\Desktop\RRW9901200241.exe Code function: 0_2_00D883D1 GetLocalTime, 0_2_00D883D1
Source: C:\Windows\SysWOW64\cmd.exe Code function: 4_2_002A443C GetVersion, 4_2_002A443C

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.383682726.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.341808975.0000000001A00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.677144358.0000000000370000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.677857555.00000000027D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.382481853.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.383234162.0000000001000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.RRW9901200241.exe.1a00000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RRW9901200241.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.RRW9901200241.exe.1a00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RRW9901200241.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.383682726.0000000001030000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.341808975.0000000001A00000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.677144358.0000000000370000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.677857555.00000000027D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.382481853.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.383234162.0000000001000000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.RRW9901200241.exe.1a00000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RRW9901200241.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.RRW9901200241.exe.1a00000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.RRW9901200241.exe.400000.0.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 339369 Sample: RRW9901200241.exe Startdate: 13/01/2021 Architecture: WINDOWS Score: 100 34 www.monkeytrivia.com 2->34 38 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->38 40 Found malware configuration 2->40 42 Malicious sample detected (through community Yara rule) 2->42 44 6 other signatures 2->44 11 RRW9901200241.exe 2->11         started        signatures3 process4 signatures5 52 Maps a DLL or memory area into another process 11->52 54 Tries to detect virtualization through RDTSC time measurements 11->54 14 RRW9901200241.exe 11->14         started        process6 signatures7 56 Modifies the context of a thread in another process (thread injection) 14->56 58 Maps a DLL or memory area into another process 14->58 60 Sample uses process hollowing technique 14->60 62 Queues an APC in another process (thread injection) 14->62 17 explorer.exe 14->17 injected process8 dnsIp9 28 www.unitvn.com 112.213.89.130, 49755, 80 SUPERDATA-AS-VNSUPERDATA-VN Viet Nam 17->28 30 www.toastxpress.com 161.35.25.247, 49748, 80 DIGITALOCEAN-ASNUS United States 17->30 32 5 other IPs or domains 17->32 36 System process connects to network (likely due to code injection or exploit) 17->36 21 cmd.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
112.213.89.130
unknown Viet Nam
45544 SUPERDATA-AS-VNSUPERDATA-VN true
161.35.25.247
unknown United States
14061 DIGITALOCEAN-ASNUS true
18.209.115.26
unknown United States
14618 AMAZON-AESUS true

Private

IP
192.168.2.1

Contacted Domains

Name IP Active
7852bigbucktrail.info 18.209.115.26 true
www.toastxpress.com 161.35.25.247 true
www.unitvn.com 112.213.89.130 true
www.monkeytrivia.com 156.238.82.35 true
www.grayfoxden.com unknown unknown
www.7852bigbucktrail.info unknown unknown
www.catatan-matematika.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.7852bigbucktrail.info/krc/?Bv=CDu2q1wwlPol/aaE7LTgnX8K53P3sg99O/jiiFC4V2fCANwRdAJcp+ZFqaBz9HB2y9P2V6qKww==&J494p=ARALpBVpxtEXKvT0 true
  • Avira URL Cloud: safe
unknown
http://www.unitvn.com/krc/?Bv=yIa+94l9rzehTYM3PiVfcRiVsqTAPcUdvzwZbg1xcjwMDM0Vsi/KUjipuHGUDzRPALJr1HG4xA==&J494p=ARALpBVpxtEXKvT0 true
  • Avira URL Cloud: malware
unknown