Analysis Report cryptedprof.exe

AV Detection:

Found malware configuration

Source: 3.2.cryptedprof.exe.400000.0.raw.unpack

Malware Configuration Extractor: FormBook {"C2 list": ["www.warungsuntik.com/rcv/"], "decoy": ["dorlandoconstruction.com", "houswifekelly.com", "thunderprnet.com", "licipo.com", "ecocotte.com", "xt.show", "sneakerbyhailss.com", "xn--xcke3b8f283o9jzd.com", "1915dobbindr.com", "njbroncosfootball.com", "xn--missrosmakeup-vhb.com", "poertz.com", "20gb-internett-hediye.com", "legalprotech.com", "smarttechnetworks.com", "jamusedwards.com", "smartsettleinfinity.com", "dizesh.com", "gnoccho.com", "historyzapper.com", "sdponcologypatientaid.com", "tabandolano.online", "iveysmotorlodgeme.com", "e-market88.com", "carpetlaunch.com", "creativeladder.net", "bjhysz.com", "befton.ovh", "kehadiransiswa.online", "trunglet.com", "warrenswelding.online", "sculptedspa.com", "avalon78m.online", "diverseworker.com", "sounongwang.com", "sanaugustinegardenresort.com", "active-trinity.com", "thatlocaljawn.com", "myadamandsteve.com", "yourbestpprazdnik.club", "pop2.online", "gavinlurssen.com", "everybodywantstobfamous.com", "shegimx.com", "qbluebaypanowdbuy.com", "peatedbrandy.online", "weightsandweed.com", "remotepowers.com", "yangguangdiannao.com", "ruecedu.com", "honeybadgerpodcast.com", "ivario.cloud", "indeep-events.com", "luzshoesr.online", "lanskyee.com", "chinalsgroup.com", "divanna-box.site", "reginajewerlyco.com", "voshtravels.com", "isahil.tech", "smartloanbuilder.net", "dojosinaptico.com", "finik.clinic", "columbus-luxury-hotels.com"]}

Multi AV Scanner detection for submitted file

Source: cryptedprof.exe

ReversingLabs: Detection: 27%

Yara detected FormBook

Source: Yara match	File source: 00000003.00000001.332707459.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388099224.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.335904498.0000000002A60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388332854.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388307234.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.591652804.0000000002C60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.590578068.00000000003D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cryptedprof.exe.2a60000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cryptedprof.exe.2a60000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: cryptedprof.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 3.1.cryptedprof.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.cryptedprof.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.cryptedprof.exe.2a60000.5.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: cryptedprof.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: cryptedprof.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.354086786.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: msdt.pdbGCTL source: cryptedprof.exe, 00000003.00000002.389071974.0000000002830000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: cryptedprof.exe, 00000001.00000003.334189202.0000000002C50000.00000004.00000001.sdmp, cryptedprof.exe, 00000003.00000002.388641562.0000000000BAF000.00000040.00000001.sdmp, msdt.exe, 00000007.00000002.592508394.000000000478F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: cryptedprof.exe, msdt.exe
Source:	Binary string: msdt.pdb source: cryptedprof.exe, 00000003.00000002.389071974.0000000002830000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.354086786.000000000DC20000.00000002.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_00405A15 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		1_2_00405A15
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_004065C1 FindFirstFileA,FindClose,		1_2_004065C1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_004027A1 FindFirstFileA,		1_2_004027A1

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 4x nop then pop ebx		3_2_00407AFA
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 4x nop then pop ebx		7_2_02C67AFB

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49746 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49746 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49746 -> 34.102.136.180:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 111.221.46.49:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 111.221.46.49:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49753 -> 111.221.46.49:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.warungsuntik.com/rcv/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /rcv/?VRNh=cg6bZkxEcNPMAIRmM8GPonkuA9GKh0BFEGdQJ3UU0rDFwE5vgU0uCiOyxYirtUdr8QJdvBkiGw==&jL08l2=WXL00450GFoHk HTTP/1.1Host: www.thatlocaljawn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /rcv/?VRNh=pIfKS/hEN6BRYAYnpceiijGTuCPe5XtNGOPRhmV5L9BR4RtlzZsfp+6kyczwPilyRouSrFb70A==&jL08l2=WXL00450GFoHk HTTP/1.1Host: www.warungsuntik.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /rcv/?VRNh=Csk4gi0A2teOHchNxlHmfk3sZkNUWHShkT6DsNvEbOeCI6G9DGd1jjRyJ2sIZ3rQDjWWzUwybw==&jL08l2=WXL00450GFoHk HTTP/1.1Host: www.tabandolano.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 34.102.136.180 34.102.136.180

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: GOOGLEUS GOOGLEUS
Source: Joe Sandbox View	ASN Name: CLAYERLIMITED-AS-APClayerLimitedHK CLAYERLIMITED-AS-APClayerLimitedHK

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /rcv/?VRNh=cg6bZkxEcNPMAIRmM8GPonkuA9GKh0BFEGdQJ3UU0rDFwE5vgU0uCiOyxYirtUdr8QJdvBkiGw==&jL08l2=WXL00450GFoHk HTTP/1.1Host: www.thatlocaljawn.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /rcv/?VRNh=pIfKS/hEN6BRYAYnpceiijGTuCPe5XtNGOPRhmV5L9BR4RtlzZsfp+6kyczwPilyRouSrFb70A==&jL08l2=WXL00450GFoHk HTTP/1.1Host: www.warungsuntik.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /rcv/?VRNh=Csk4gi0A2teOHchNxlHmfk3sZkNUWHShkT6DsNvEbOeCI6G9DGd1jjRyJ2sIZ3rQDjWWzUwybw==&jL08l2=WXL00450GFoHk HTTP/1.1Host: www.tabandolano.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.thatlocaljawn.com

Tries to download or post to a non-existing http route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Tue, 23 Feb 2021 14:32:22 GMTContent-Type: text/htmlContent-Length: 479Connection: closeETag: "601d0d01-1df"Data Raw: 3c 21 64 6f 63 74 79 70 65 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 58 2d 55 41 2d 43 6f 6d 70 61 74 69 62 6c 65 22 20 63 6f 6e 74 65 6e 74 3d 22 49 45 3d 65 64 67 65 22 3e 0a 3c 6d 65 74 61 20 6e 61 6d 65 3d 22 76 69 65 77 70 6f 72 74 22 20 63 6f 6e 74 65 6e 74 3d 22 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 2c 20 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 61 78 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 75 73 65 72 2d 73 63 61 6c 61 62 6c 65 3d 6e 6f 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 3e 0a 09 62 6f 64 79 7b 0a 09 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 34 34 34 3b 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 31 34 70 78 3b 0a 09 7d 0a 09 68 33 7b 0a 09 09 66 6f 6e 74 2d 73 69 7a 65 3a 36 30 70 78 3b 0a 09 09 63 6f 6c 6f 72 3a 23 65 65 65 3b 0a 09 09 74 65 78 74 2d 61 6c 69 67 6e 3a 63 65 6e 74 65 72 3b 0a 09 09 70 61 64 64 69 6e 67 2d 74 6f 70 3a 33 30 70 78 3b 0a 09 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 6e 6f 72 6d 61 6c 3b 0a 09 7d 0a 3c 2f 73 74 79 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 0a 3c 62 6f 64 79 3e 0a 3c 68 33 3e 34 30 34 ef bc 8c e6 82 a8 e8 af b7 e6 b1 82 e7 9a 84 e6 96 87 e4 bb b6 e4 b8 8d e5 ad 98 e5 9c a8 21 3c 2f 68 33 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!doctype html><html><head><meta charset="utf-8"><meta http-equiv="X-UA-Compatible" content="IE=edge"><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1, user-scalable=no"><title>404</title><style>body{background-color:#444;font-size:14px;}h3{font-size:60px;color:#eee;text-align:center;padding-top:30px;font-weight:normal;}</style></head><body><h3>404!</h3></body></html>

Urls found in memory or binary data

Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: cryptedprof.exe	String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: cryptedprof.exe	String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.338525692.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: msdt.exe, 00000007.00000002.594068714.000000000508F000.00000004.00000001.sdmp	String found in binary or memory: http://www.tabandolano.online/cgi-sys/suspendedpage.cgi?VRNh=Csk4gi0A2teOHchNxlHmfk3sZkNUWHShkT6DsNv
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.352954703.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_004054B2 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_004054B2

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000001.332707459.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388099224.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.335904498.0000000002A60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388332854.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388307234.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.591652804.0000000002C60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.590578068.00000000003D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cryptedprof.exe.2a60000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cryptedprof.exe.2a60000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000003.00000001.332707459.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000001.332707459.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.388099224.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.388099224.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.335904498.0000000002A60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.335904498.0000000002A60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.388332854.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.388332854.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.388307234.00000000009C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.388307234.00000000009C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.591652804.0000000002C60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.591652804.0000000002C60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.590578068.00000000003D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.590578068.00000000003D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.cryptedprof.exe.2a60000.5.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.cryptedprof.exe.2a60000.5.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.cryptedprof.exe.2a60000.5.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.cryptedprof.exe.2a60000.5.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00419D60 NtCreateFile,		3_2_00419D60
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00419E10 NtReadFile,		3_2_00419E10
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00419E90 NtClose,		3_2_00419E90
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00419F40 NtAllocateVirtualMemory,		3_2_00419F40
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00419D5A NtCreateFile,		3_2_00419D5A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00419DB4 NtReadFile,		3_2_00419DB4
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00419E8A NtClose,		3_2_00419E8A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00419F3C NtAllocateVirtualMemory,		3_2_00419F3C
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF98F0 NtReadVirtualMemory,LdrInitializeThunk,		3_2_00AF98F0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9860 NtQuerySystemInformation,LdrInitializeThunk,		3_2_00AF9860
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9840 NtDelayExecution,LdrInitializeThunk,		3_2_00AF9840
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF99A0 NtCreateSection,LdrInitializeThunk,		3_2_00AF99A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		3_2_00AF9910
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9A20 NtResumeThread,LdrInitializeThunk,		3_2_00AF9A20
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9A00 NtProtectVirtualMemory,LdrInitializeThunk,		3_2_00AF9A00
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9A50 NtCreateFile,LdrInitializeThunk,		3_2_00AF9A50
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF95D0 NtClose,LdrInitializeThunk,		3_2_00AF95D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9540 NtReadFile,LdrInitializeThunk,		3_2_00AF9540
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF96E0 NtFreeVirtualMemory,LdrInitializeThunk,		3_2_00AF96E0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9660 NtAllocateVirtualMemory,LdrInitializeThunk,		3_2_00AF9660
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF97A0 NtUnmapViewOfSection,LdrInitializeThunk,		3_2_00AF97A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9780 NtMapViewOfSection,LdrInitializeThunk,		3_2_00AF9780
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9710 NtQueryInformationToken,LdrInitializeThunk,		3_2_00AF9710
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF98A0 NtWriteVirtualMemory,		3_2_00AF98A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9820 NtEnumerateKey,		3_2_00AF9820
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AFB040 NtSuspendThread,		3_2_00AFB040
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF99D0 NtCreateProcessEx,		3_2_00AF99D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9950 NtQueueApcThread,		3_2_00AF9950
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9A80 NtOpenDirectoryObject,		3_2_00AF9A80
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9A10 NtQuerySection,		3_2_00AF9A10
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AFA3B0 NtGetContextThread,		3_2_00AFA3B0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9B00 NtSetValueKey,		3_2_00AF9B00
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF95F0 NtQueryInformationFile,		3_2_00AF95F0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9520 NtWaitForSingleObject,		3_2_00AF9520
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AFAD30 NtSetContextThread,		3_2_00AFAD30
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9560 NtWriteFile,		3_2_00AF9560
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF96D0 NtCreateKey,		3_2_00AF96D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9610 NtEnumerateValueKey,		3_2_00AF9610
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9670 NtQueryInformationProcess,		3_2_00AF9670
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF9650 NtQueryValueKey,		3_2_00AF9650
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9860 NtQuerySystemInformation,LdrInitializeThunk,		7_2_046D9860
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9840 NtDelayExecution,LdrInitializeThunk,		7_2_046D9840
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9540 NtReadFile,LdrInitializeThunk,		7_2_046D9540
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		7_2_046D9910
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D95D0 NtClose,LdrInitializeThunk,		7_2_046D95D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D99A0 NtCreateSection,LdrInitializeThunk,		7_2_046D99A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9660 NtAllocateVirtualMemory,LdrInitializeThunk,		7_2_046D9660
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9A50 NtCreateFile,LdrInitializeThunk,		7_2_046D9A50
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9650 NtQueryValueKey,LdrInitializeThunk,		7_2_046D9650
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D96E0 NtFreeVirtualMemory,LdrInitializeThunk,		7_2_046D96E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D96D0 NtCreateKey,LdrInitializeThunk,		7_2_046D96D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9710 NtQueryInformationToken,LdrInitializeThunk,		7_2_046D9710
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9FE0 NtCreateMutant,LdrInitializeThunk,		7_2_046D9FE0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9780 NtMapViewOfSection,LdrInitializeThunk,		7_2_046D9780
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046DB040 NtSuspendThread,		7_2_046DB040
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9820 NtEnumerateKey,		7_2_046D9820
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D98F0 NtReadVirtualMemory,		7_2_046D98F0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D98A0 NtWriteVirtualMemory,		7_2_046D98A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9560 NtWriteFile,		7_2_046D9560
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9950 NtQueueApcThread,		7_2_046D9950
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9520 NtWaitForSingleObject,		7_2_046D9520
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046DAD30 NtSetContextThread,		7_2_046DAD30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D95F0 NtQueryInformationFile,		7_2_046D95F0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D99D0 NtCreateProcessEx,		7_2_046D99D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9670 NtQueryInformationProcess,		7_2_046D9670
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9A20 NtResumeThread,		7_2_046D9A20
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9A00 NtProtectVirtualMemory,		7_2_046D9A00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9610 NtEnumerateValueKey,		7_2_046D9610
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9A10 NtQuerySection,		7_2_046D9A10
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9A80 NtOpenDirectoryObject,		7_2_046D9A80
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9760 NtOpenProcess,		7_2_046D9760
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9770 NtSetInformationFile,		7_2_046D9770
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046DA770 NtOpenThread,		7_2_046DA770
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9730 NtQueryVirtualMemory,		7_2_046D9730
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D9B00 NtSetValueKey,		7_2_046D9B00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046DA710 NtOpenProcessToken,		7_2_046DA710
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D97A0 NtUnmapViewOfSection,		7_2_046D97A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046DA3B0 NtGetContextThread,		7_2_046DA3B0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C79E90 NtClose,		7_2_02C79E90
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C79E10 NtReadFile,		7_2_02C79E10
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C79F40 NtAllocateVirtualMemory,		7_2_02C79F40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C79D60 NtCreateFile,		7_2_02C79D60
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C79E8A NtClose,		7_2_02C79E8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C79F3C NtAllocateVirtualMemory,		7_2_02C79F3C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C79DB4 NtReadFile,		7_2_02C79DB4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C79D5A NtCreateFile,		7_2_02C79D5A

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_00403486 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_00403486

Detected potential crypto function

Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_00407272		1_2_00407272
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_00406A9B		1_2_00406A9B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_70991A98		1_2_70991A98
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00401027		3_2_00401027
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00401030		3_2_00401030
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041E03E		3_2_0041E03E
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041E2A1		3_2_0041E2A1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041D38B		3_2_0041D38B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041D5F1		3_2_0041D5F1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00402D90		3_2_00402D90
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00409E40		3_2_00409E40
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00409E3B		3_2_00409E3B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041DF46		3_2_0041DF46
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041CFA6		3_2_0041CFA6
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00402FB0		3_2_00402FB0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE20A0		3_2_00AE20A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B820A8		3_2_00B820A8
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACB090		3_2_00ACB090
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B828EC		3_2_00B828EC
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B8E824		3_2_00B8E824
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA830		3_2_00ADA830
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71002		3_2_00B71002
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD4120		3_2_00AD4120
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABF900		3_2_00ABF900
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B822AE		3_2_00B822AE
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B6FA2B		3_2_00B6FA2B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEEBB0		3_2_00AEEBB0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B623E3		3_2_00B623E3
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7DBD2		3_2_00B7DBD2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B703DA		3_2_00B703DA
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEABD8		3_2_00AEABD8
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B82B28		3_2_00B82B28
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADAB40		3_2_00ADAB40
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC841F		3_2_00AC841F
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7D466		3_2_00B7D466
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2581		3_2_00AE2581
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACD5E0		3_2_00ACD5E0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B825DD		3_2_00B825DD
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB0D20		3_2_00AB0D20
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B82D07		3_2_00B82D07
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B81D55		3_2_00B81D55
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B82EF7		3_2_00B82EF7
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD6E30		3_2_00AD6E30
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7D616		3_2_00B7D616
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A841F		7_2_046A841F
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751002		7_2_04751002
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C20A0		7_2_046C20A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047620A8		7_2_047620A8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046AB090		7_2_046AB090
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04761D55		7_2_04761D55
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04690D20		7_2_04690D20
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B4120		7_2_046B4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0469F900		7_2_0469F900
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04762D07		7_2_04762D07
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046AD5E0		7_2_046AD5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C2581		7_2_046C2581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B6E30		7_2_046B6E30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04762EF7		7_2_04762EF7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047622AE		7_2_047622AE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04762B28		7_2_04762B28
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04761FF1		7_2_04761FF1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0475DBD2		7_2_0475DBD2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046CEBB0		7_2_046CEBB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C7E2A1		7_2_02C7E2A1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C7D38B		7_2_02C7D38B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C7E03E		7_2_02C7E03E
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C69E40		7_2_02C69E40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C69E3B		7_2_02C69E3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C7CFA6		7_2_02C7CFA6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C62FB0		7_2_02C62FB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C62D90		7_2_02C62D90

Found potential string decryption / allocating functions

Source: C:\Windows\SysWOW64\msdt.exe	Code function: String function: 0469B150 appears 35 times
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: String function: 00ABB150 appears 121 times

PE file contains strange resources

Source: cryptedprof.exe

Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: cryptedprof.exe, 00000001.00000003.327029205.0000000002D3F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs cryptedprof.exe
Source: cryptedprof.exe, 00000001.00000002.335855090.00000000028F0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs cryptedprof.exe
Source: cryptedprof.exe, 00000003.00000002.388818719.0000000000D3F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs cryptedprof.exe
Source: cryptedprof.exe, 00000003.00000002.389071974.0000000002830000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamemsdt.exej% vs cryptedprof.exe

Uses 32bit PE files

Source: cryptedprof.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 00000003.00000001.332707459.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000001.332707459.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.388099224.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.388099224.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.335904498.0000000002A60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.335904498.0000000002A60000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.388332854.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.388332854.00000000009F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.388307234.00000000009C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.388307234.00000000009C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.591652804.0000000002C60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.591652804.0000000002C60000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.590578068.00000000003D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.590578068.00000000003D0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.cryptedprof.exe.2a60000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.cryptedprof.exe.2a60000.5.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.cryptedprof.exe.2a60000.5.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.cryptedprof.exe.2a60000.5.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/4@3/3

Contains functionality to adjust token privileges (e.g. debug / backup)

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_00403486 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_00403486

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_00404763 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

1_2_00404763

Contains functionality to enum processes or threads

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_6FC2421B CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,

1_2_6FC2421B

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_0040216B CoCreateInstance,MultiByteToWideChar,

1_2_0040216B

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6608:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\cryptedprof.exe

File created: C:\Users\user\AppData\Local\Temp\nsv1C7.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: cryptedprof.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\cryptedprof.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\cryptedprof.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: cryptedprof.exe

ReversingLabs: Detection: 27%

Sample reads its own file content

Source: C:\Users\user\Desktop\cryptedprof.exe

File read: C:\Users\user\Desktop\cryptedprof.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\cryptedprof.exe 'C:\Users\user\Desktop\cryptedprof.exe'
Source: unknown	Process created: C:\Users\user\Desktop\cryptedprof.exe 'C:\Users\user\Desktop\cryptedprof.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\cryptedprof.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\cryptedprof.exe	Process created: C:\Users\user\Desktop\cryptedprof.exe 'C:\Users\user\Desktop\cryptedprof.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\cryptedprof.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\cryptedprof.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32

Jump to behavior

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: cryptedprof.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.354086786.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: msdt.pdbGCTL source: cryptedprof.exe, 00000003.00000002.389071974.0000000002830000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: cryptedprof.exe, 00000001.00000003.334189202.0000000002C50000.00000004.00000001.sdmp, cryptedprof.exe, 00000003.00000002.388641562.0000000000BAF000.00000040.00000001.sdmp, msdt.exe, 00000007.00000002.592508394.000000000478F000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: cryptedprof.exe, msdt.exe
Source:	Binary string: msdt.pdb source: cryptedprof.exe, 00000003.00000002.389071974.0000000002830000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.354086786.000000000DC20000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\cryptedprof.exe

Unpacked PE file: 3.2.cryptedprof.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_70991A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

1_2_70991A98

PE file contains sections with non-standard names

Source: 8chdn.dll.1.dr

Static PE information: section name: .code

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_70992F60 push eax; ret		1_2_70992F8E
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00416A63 push esp; retf		3_2_00416AAE
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00416AF0 pushfd ; iretd		3_2_00416AF1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00416AA8 push esp; retf		3_2_00416AAE
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00417B8F push ebp; ret		3_2_00417B93
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_004173B1 push edx; retf		3_2_004173BA
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_004135D2 push cs; ret		3_2_004135DF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041CEB5 push eax; ret		3_2_0041CF08
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041CF6C push eax; ret		3_2_0041CF72
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041CF02 push eax; ret		3_2_0041CF08
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_0041CF0B push eax; ret		3_2_0041CF72
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B0D0D1 push ecx; ret		3_2_00B0D0E4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046ED0D1 push ecx; ret		7_2_046ED0E4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C76AF0 pushfd ; iretd		7_2_02C76AF1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C76AA8 push esp; retf		7_2_02C76AAE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C76A63 push esp; retf		7_2_02C76AAE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C77B8F push ebp; ret		7_2_02C77B93
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C773B1 push edx; retf		7_2_02C773BA
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C7CEB5 push eax; ret		7_2_02C7CF08
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C7CF6C push eax; ret		7_2_02C7CF72
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C7CF02 push eax; ret		7_2_02C7CF08
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C7CF0B push eax; ret		7_2_02C7CF72
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_02C735D2 push cs; ret		7_2_02C735DF

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .data entropy: 7.23183783874

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\cryptedprof.exe	File created: C:\Users\user\AppData\Local\Temp\nsl227.tmp\System.dll			Jump to dropped file
Source: C:\Users\user\Desktop\cryptedprof.exe	File created: C:\Users\user\AppData\Local\Temp\8chdn.dll			Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Modifies the prolog of user mode functions (user mode inline hooks)

Source: explorer.exe

User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8D 0xDE 0xEA

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\cryptedprof.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\cryptedprof.exe	RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\cryptedprof.exe	RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 0000000002C698E4 second address: 0000000002C698EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 0000000002C69B5E second address: 0000000002C69B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\cryptedprof.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 3_2_00409A90 rdtsc

3_2_00409A90

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 4928

Thread sleep time: -58000s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\explorer.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_00405A15 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose,		1_2_00405A15
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_004065C1 FindFirstFileA,FindClose,		1_2_004065C1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_004027A1 FindFirstFileA,		1_2_004027A1

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000005.00000000.351832152.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000002.601400852.000000000461E000.00000004.00000001.sdmp	Binary or memory string: @%SystemRoot%\System32\mswsock.dll,-60200-9%SystemRoot%\system32\mswsock.dlle6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&%
Source: explorer.exe, 00000005.00000000.351918653.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.345049804.000000000461E000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.346745168.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.349105982.0000000006410000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.351832152.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000000.351603974.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: explorer.exe, 00000005.00000000.349105982.0000000006410000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.351603974.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000005.00000000.346745168.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.346745168.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.351603974.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000005.00000000.351918653.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000005.00000000.338525692.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000005.00000000.346745168.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\cryptedprof.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\cryptedprof.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 3_2_00409A90 rdtsc

3_2_00409A90

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 3_2_0040ACD0 LdrLoadDll,

3_2_0040ACD0

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_70991A98 GlobalAlloc,lstrcpyA,lstrcpyA,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyA,GetModuleHandleA,LoadLibraryA,GetProcAddress,lstrlenA,

1_2_70991A98

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_6FC24582 mov eax, dword ptr fs:[00000030h]		1_2_6FC24582
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 1_2_6FC24785 mov eax, dword ptr fs:[00000030h]		1_2_6FC24785
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF90AF mov eax, dword ptr fs:[00000030h]		3_2_00AF90AF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE20A0 mov eax, dword ptr fs:[00000030h]		3_2_00AE20A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE20A0 mov eax, dword ptr fs:[00000030h]		3_2_00AE20A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE20A0 mov eax, dword ptr fs:[00000030h]		3_2_00AE20A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE20A0 mov eax, dword ptr fs:[00000030h]		3_2_00AE20A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE20A0 mov eax, dword ptr fs:[00000030h]		3_2_00AE20A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE20A0 mov eax, dword ptr fs:[00000030h]		3_2_00AE20A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEF0BF mov ecx, dword ptr fs:[00000030h]		3_2_00AEF0BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEF0BF mov eax, dword ptr fs:[00000030h]		3_2_00AEF0BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEF0BF mov eax, dword ptr fs:[00000030h]		3_2_00AEF0BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB9080 mov eax, dword ptr fs:[00000030h]		3_2_00AB9080
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B33884 mov eax, dword ptr fs:[00000030h]		3_2_00B33884
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B33884 mov eax, dword ptr fs:[00000030h]		3_2_00B33884
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB58EC mov eax, dword ptr fs:[00000030h]		3_2_00AB58EC
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADB8E4 mov eax, dword ptr fs:[00000030h]		3_2_00ADB8E4
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADB8E4 mov eax, dword ptr fs:[00000030h]		3_2_00ADB8E4
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB40E1 mov eax, dword ptr fs:[00000030h]		3_2_00AB40E1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB40E1 mov eax, dword ptr fs:[00000030h]		3_2_00AB40E1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB40E1 mov eax, dword ptr fs:[00000030h]		3_2_00AB40E1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00B4B8D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4B8D0 mov ecx, dword ptr fs:[00000030h]		3_2_00B4B8D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00B4B8D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00B4B8D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00B4B8D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00B4B8D0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE002D mov eax, dword ptr fs:[00000030h]		3_2_00AE002D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE002D mov eax, dword ptr fs:[00000030h]		3_2_00AE002D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE002D mov eax, dword ptr fs:[00000030h]		3_2_00AE002D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE002D mov eax, dword ptr fs:[00000030h]		3_2_00AE002D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE002D mov eax, dword ptr fs:[00000030h]		3_2_00AE002D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACB02A mov eax, dword ptr fs:[00000030h]		3_2_00ACB02A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACB02A mov eax, dword ptr fs:[00000030h]		3_2_00ACB02A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACB02A mov eax, dword ptr fs:[00000030h]		3_2_00ACB02A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACB02A mov eax, dword ptr fs:[00000030h]		3_2_00ACB02A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA830 mov eax, dword ptr fs:[00000030h]		3_2_00ADA830
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA830 mov eax, dword ptr fs:[00000030h]		3_2_00ADA830
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA830 mov eax, dword ptr fs:[00000030h]		3_2_00ADA830
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA830 mov eax, dword ptr fs:[00000030h]		3_2_00ADA830
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B37016 mov eax, dword ptr fs:[00000030h]		3_2_00B37016
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B37016 mov eax, dword ptr fs:[00000030h]		3_2_00B37016
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B37016 mov eax, dword ptr fs:[00000030h]		3_2_00B37016
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B84015 mov eax, dword ptr fs:[00000030h]		3_2_00B84015
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B84015 mov eax, dword ptr fs:[00000030h]		3_2_00B84015
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B72073 mov eax, dword ptr fs:[00000030h]		3_2_00B72073
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B81074 mov eax, dword ptr fs:[00000030h]		3_2_00B81074
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD0050 mov eax, dword ptr fs:[00000030h]		3_2_00AD0050
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD0050 mov eax, dword ptr fs:[00000030h]		3_2_00AD0050
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B351BE mov eax, dword ptr fs:[00000030h]		3_2_00B351BE
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B351BE mov eax, dword ptr fs:[00000030h]		3_2_00B351BE
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B351BE mov eax, dword ptr fs:[00000030h]		3_2_00B351BE
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B351BE mov eax, dword ptr fs:[00000030h]		3_2_00B351BE
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE61A0 mov eax, dword ptr fs:[00000030h]		3_2_00AE61A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE61A0 mov eax, dword ptr fs:[00000030h]		3_2_00AE61A0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov ecx, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov ecx, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov eax, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov ecx, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov ecx, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov eax, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov ecx, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov ecx, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov eax, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov ecx, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov ecx, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD99BF mov eax, dword ptr fs:[00000030h]		3_2_00AD99BF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B749A4 mov eax, dword ptr fs:[00000030h]		3_2_00B749A4
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B749A4 mov eax, dword ptr fs:[00000030h]		3_2_00B749A4
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B749A4 mov eax, dword ptr fs:[00000030h]		3_2_00B749A4
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B749A4 mov eax, dword ptr fs:[00000030h]		3_2_00B749A4
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B369A6 mov eax, dword ptr fs:[00000030h]		3_2_00B369A6
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEA185 mov eax, dword ptr fs:[00000030h]		3_2_00AEA185
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADC182 mov eax, dword ptr fs:[00000030h]		3_2_00ADC182
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2990 mov eax, dword ptr fs:[00000030h]		3_2_00AE2990
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABB1E1 mov eax, dword ptr fs:[00000030h]		3_2_00ABB1E1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABB1E1 mov eax, dword ptr fs:[00000030h]		3_2_00ABB1E1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABB1E1 mov eax, dword ptr fs:[00000030h]		3_2_00ABB1E1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B441E8 mov eax, dword ptr fs:[00000030h]		3_2_00B441E8
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD4120 mov eax, dword ptr fs:[00000030h]		3_2_00AD4120
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD4120 mov eax, dword ptr fs:[00000030h]		3_2_00AD4120
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD4120 mov eax, dword ptr fs:[00000030h]		3_2_00AD4120
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD4120 mov eax, dword ptr fs:[00000030h]		3_2_00AD4120
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD4120 mov ecx, dword ptr fs:[00000030h]		3_2_00AD4120
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE513A mov eax, dword ptr fs:[00000030h]		3_2_00AE513A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE513A mov eax, dword ptr fs:[00000030h]		3_2_00AE513A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB9100 mov eax, dword ptr fs:[00000030h]		3_2_00AB9100
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB9100 mov eax, dword ptr fs:[00000030h]		3_2_00AB9100
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB9100 mov eax, dword ptr fs:[00000030h]		3_2_00AB9100
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABC962 mov eax, dword ptr fs:[00000030h]		3_2_00ABC962
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABB171 mov eax, dword ptr fs:[00000030h]		3_2_00ABB171
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABB171 mov eax, dword ptr fs:[00000030h]		3_2_00ABB171
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADB944 mov eax, dword ptr fs:[00000030h]		3_2_00ADB944
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADB944 mov eax, dword ptr fs:[00000030h]		3_2_00ADB944
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB52A5 mov eax, dword ptr fs:[00000030h]		3_2_00AB52A5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB52A5 mov eax, dword ptr fs:[00000030h]		3_2_00AB52A5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB52A5 mov eax, dword ptr fs:[00000030h]		3_2_00AB52A5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB52A5 mov eax, dword ptr fs:[00000030h]		3_2_00AB52A5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB52A5 mov eax, dword ptr fs:[00000030h]		3_2_00AB52A5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACAAB0 mov eax, dword ptr fs:[00000030h]		3_2_00ACAAB0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACAAB0 mov eax, dword ptr fs:[00000030h]		3_2_00ACAAB0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEFAB0 mov eax, dword ptr fs:[00000030h]		3_2_00AEFAB0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AED294 mov eax, dword ptr fs:[00000030h]		3_2_00AED294
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AED294 mov eax, dword ptr fs:[00000030h]		3_2_00AED294
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2AE4 mov eax, dword ptr fs:[00000030h]		3_2_00AE2AE4
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74AEF mov eax, dword ptr fs:[00000030h]		3_2_00B74AEF
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2ACB mov eax, dword ptr fs:[00000030h]		3_2_00AE2ACB
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF4A2C mov eax, dword ptr fs:[00000030h]		3_2_00AF4A2C
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF4A2C mov eax, dword ptr fs:[00000030h]		3_2_00AF4A2C
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA229 mov eax, dword ptr fs:[00000030h]		3_2_00ADA229
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7AA16 mov eax, dword ptr fs:[00000030h]		3_2_00B7AA16
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7AA16 mov eax, dword ptr fs:[00000030h]		3_2_00B7AA16
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC8A0A mov eax, dword ptr fs:[00000030h]		3_2_00AC8A0A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD3A1C mov eax, dword ptr fs:[00000030h]		3_2_00AD3A1C
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB5210 mov eax, dword ptr fs:[00000030h]		3_2_00AB5210
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB5210 mov ecx, dword ptr fs:[00000030h]		3_2_00AB5210
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB5210 mov eax, dword ptr fs:[00000030h]		3_2_00AB5210
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB5210 mov eax, dword ptr fs:[00000030h]		3_2_00AB5210
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABAA16 mov eax, dword ptr fs:[00000030h]		3_2_00ABAA16
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABAA16 mov eax, dword ptr fs:[00000030h]		3_2_00ABAA16
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF927A mov eax, dword ptr fs:[00000030h]		3_2_00AF927A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B6B260 mov eax, dword ptr fs:[00000030h]		3_2_00B6B260
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B6B260 mov eax, dword ptr fs:[00000030h]		3_2_00B6B260
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B88A62 mov eax, dword ptr fs:[00000030h]		3_2_00B88A62
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7EA55 mov eax, dword ptr fs:[00000030h]		3_2_00B7EA55
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B44257 mov eax, dword ptr fs:[00000030h]		3_2_00B44257
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB9240 mov eax, dword ptr fs:[00000030h]		3_2_00AB9240
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB9240 mov eax, dword ptr fs:[00000030h]		3_2_00AB9240
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB9240 mov eax, dword ptr fs:[00000030h]		3_2_00AB9240
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB9240 mov eax, dword ptr fs:[00000030h]		3_2_00AB9240
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE4BAD mov eax, dword ptr fs:[00000030h]		3_2_00AE4BAD
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE4BAD mov eax, dword ptr fs:[00000030h]		3_2_00AE4BAD
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE4BAD mov eax, dword ptr fs:[00000030h]		3_2_00AE4BAD
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B85BA5 mov eax, dword ptr fs:[00000030h]		3_2_00B85BA5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC1B8F mov eax, dword ptr fs:[00000030h]		3_2_00AC1B8F
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC1B8F mov eax, dword ptr fs:[00000030h]		3_2_00AC1B8F
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B6D380 mov ecx, dword ptr fs:[00000030h]		3_2_00B6D380
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2397 mov eax, dword ptr fs:[00000030h]		3_2_00AE2397
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7138A mov eax, dword ptr fs:[00000030h]		3_2_00B7138A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEB390 mov eax, dword ptr fs:[00000030h]		3_2_00AEB390
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADDBE9 mov eax, dword ptr fs:[00000030h]		3_2_00ADDBE9
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE03E2 mov eax, dword ptr fs:[00000030h]		3_2_00AE03E2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE03E2 mov eax, dword ptr fs:[00000030h]		3_2_00AE03E2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE03E2 mov eax, dword ptr fs:[00000030h]		3_2_00AE03E2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE03E2 mov eax, dword ptr fs:[00000030h]		3_2_00AE03E2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE03E2 mov eax, dword ptr fs:[00000030h]		3_2_00AE03E2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE03E2 mov eax, dword ptr fs:[00000030h]		3_2_00AE03E2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B623E3 mov ecx, dword ptr fs:[00000030h]		3_2_00B623E3
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B623E3 mov ecx, dword ptr fs:[00000030h]		3_2_00B623E3
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B623E3 mov eax, dword ptr fs:[00000030h]		3_2_00B623E3
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B353CA mov eax, dword ptr fs:[00000030h]		3_2_00B353CA
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B353CA mov eax, dword ptr fs:[00000030h]		3_2_00B353CA
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADA309 mov eax, dword ptr fs:[00000030h]		3_2_00ADA309
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7131B mov eax, dword ptr fs:[00000030h]		3_2_00B7131B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABDB60 mov ecx, dword ptr fs:[00000030h]		3_2_00ABDB60
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE3B7A mov eax, dword ptr fs:[00000030h]		3_2_00AE3B7A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE3B7A mov eax, dword ptr fs:[00000030h]		3_2_00AE3B7A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B88B58 mov eax, dword ptr fs:[00000030h]		3_2_00B88B58
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABDB40 mov eax, dword ptr fs:[00000030h]		3_2_00ABDB40
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABF358 mov eax, dword ptr fs:[00000030h]		3_2_00ABF358
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B74496 mov eax, dword ptr fs:[00000030h]		3_2_00B74496
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC849B mov eax, dword ptr fs:[00000030h]		3_2_00AC849B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36CF0 mov eax, dword ptr fs:[00000030h]		3_2_00B36CF0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36CF0 mov eax, dword ptr fs:[00000030h]		3_2_00B36CF0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36CF0 mov eax, dword ptr fs:[00000030h]		3_2_00B36CF0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B714FB mov eax, dword ptr fs:[00000030h]		3_2_00B714FB
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B88CD6 mov eax, dword ptr fs:[00000030h]		3_2_00B88CD6
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEBC2C mov eax, dword ptr fs:[00000030h]		3_2_00AEBC2C
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71C06 mov eax, dword ptr fs:[00000030h]		3_2_00B71C06
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B8740D mov eax, dword ptr fs:[00000030h]		3_2_00B8740D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B8740D mov eax, dword ptr fs:[00000030h]		3_2_00B8740D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B8740D mov eax, dword ptr fs:[00000030h]		3_2_00B8740D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36C0A mov eax, dword ptr fs:[00000030h]		3_2_00B36C0A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36C0A mov eax, dword ptr fs:[00000030h]		3_2_00B36C0A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36C0A mov eax, dword ptr fs:[00000030h]		3_2_00B36C0A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36C0A mov eax, dword ptr fs:[00000030h]		3_2_00B36C0A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD746D mov eax, dword ptr fs:[00000030h]		3_2_00AD746D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEAC7B mov eax, dword ptr fs:[00000030h]		3_2_00AEAC7B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4C450 mov eax, dword ptr fs:[00000030h]		3_2_00B4C450
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4C450 mov eax, dword ptr fs:[00000030h]		3_2_00B4C450
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEA44B mov eax, dword ptr fs:[00000030h]		3_2_00AEA44B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE35A1 mov eax, dword ptr fs:[00000030h]		3_2_00AE35A1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B805AC mov eax, dword ptr fs:[00000030h]		3_2_00B805AC
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B805AC mov eax, dword ptr fs:[00000030h]		3_2_00B805AC
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE1DB5 mov eax, dword ptr fs:[00000030h]		3_2_00AE1DB5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE1DB5 mov eax, dword ptr fs:[00000030h]		3_2_00AE1DB5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE1DB5 mov eax, dword ptr fs:[00000030h]		3_2_00AE1DB5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB2D8A mov eax, dword ptr fs:[00000030h]		3_2_00AB2D8A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB2D8A mov eax, dword ptr fs:[00000030h]		3_2_00AB2D8A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB2D8A mov eax, dword ptr fs:[00000030h]		3_2_00AB2D8A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB2D8A mov eax, dword ptr fs:[00000030h]		3_2_00AB2D8A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AB2D8A mov eax, dword ptr fs:[00000030h]		3_2_00AB2D8A
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2581 mov eax, dword ptr fs:[00000030h]		3_2_00AE2581
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2581 mov eax, dword ptr fs:[00000030h]		3_2_00AE2581
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2581 mov eax, dword ptr fs:[00000030h]		3_2_00AE2581
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE2581 mov eax, dword ptr fs:[00000030h]		3_2_00AE2581
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEFD9B mov eax, dword ptr fs:[00000030h]		3_2_00AEFD9B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEFD9B mov eax, dword ptr fs:[00000030h]		3_2_00AEFD9B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B68DF1 mov eax, dword ptr fs:[00000030h]		3_2_00B68DF1
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACD5E0 mov eax, dword ptr fs:[00000030h]		3_2_00ACD5E0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ACD5E0 mov eax, dword ptr fs:[00000030h]		3_2_00ACD5E0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7FDE2 mov eax, dword ptr fs:[00000030h]		3_2_00B7FDE2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7FDE2 mov eax, dword ptr fs:[00000030h]		3_2_00B7FDE2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7FDE2 mov eax, dword ptr fs:[00000030h]		3_2_00B7FDE2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7FDE2 mov eax, dword ptr fs:[00000030h]		3_2_00B7FDE2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36DC9 mov eax, dword ptr fs:[00000030h]		3_2_00B36DC9
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36DC9 mov eax, dword ptr fs:[00000030h]		3_2_00B36DC9
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36DC9 mov eax, dword ptr fs:[00000030h]		3_2_00B36DC9
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36DC9 mov ecx, dword ptr fs:[00000030h]		3_2_00B36DC9
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36DC9 mov eax, dword ptr fs:[00000030h]		3_2_00B36DC9
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B36DC9 mov eax, dword ptr fs:[00000030h]		3_2_00B36DC9
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B3A537 mov eax, dword ptr fs:[00000030h]		3_2_00B3A537
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B88D34 mov eax, dword ptr fs:[00000030h]		3_2_00B88D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7E539 mov eax, dword ptr fs:[00000030h]		3_2_00B7E539
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE4D3B mov eax, dword ptr fs:[00000030h]		3_2_00AE4D3B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE4D3B mov eax, dword ptr fs:[00000030h]		3_2_00AE4D3B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE4D3B mov eax, dword ptr fs:[00000030h]		3_2_00AE4D3B
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC3D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC3D34
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABAD30 mov eax, dword ptr fs:[00000030h]		3_2_00ABAD30
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADC577 mov eax, dword ptr fs:[00000030h]		3_2_00ADC577
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADC577 mov eax, dword ptr fs:[00000030h]		3_2_00ADC577
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF3D43 mov eax, dword ptr fs:[00000030h]		3_2_00AF3D43
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B33540 mov eax, dword ptr fs:[00000030h]		3_2_00B33540
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B63D40 mov eax, dword ptr fs:[00000030h]		3_2_00B63D40
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AD7D50 mov eax, dword ptr fs:[00000030h]		3_2_00AD7D50
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B346A7 mov eax, dword ptr fs:[00000030h]		3_2_00B346A7
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B80EA5 mov eax, dword ptr fs:[00000030h]		3_2_00B80EA5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B80EA5 mov eax, dword ptr fs:[00000030h]		3_2_00B80EA5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B80EA5 mov eax, dword ptr fs:[00000030h]		3_2_00B80EA5
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B4FE87 mov eax, dword ptr fs:[00000030h]		3_2_00B4FE87
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE16E0 mov ecx, dword ptr fs:[00000030h]		3_2_00AE16E0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC76E2 mov eax, dword ptr fs:[00000030h]		3_2_00AC76E2
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE36CC mov eax, dword ptr fs:[00000030h]		3_2_00AE36CC
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AF8EC7 mov eax, dword ptr fs:[00000030h]		3_2_00AF8EC7
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B88ED6 mov eax, dword ptr fs:[00000030h]		3_2_00B88ED6
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B6FEC0 mov eax, dword ptr fs:[00000030h]		3_2_00B6FEC0
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B6FE3F mov eax, dword ptr fs:[00000030h]		3_2_00B6FE3F
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABE620 mov eax, dword ptr fs:[00000030h]		3_2_00ABE620
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABC600 mov eax, dword ptr fs:[00000030h]		3_2_00ABC600
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABC600 mov eax, dword ptr fs:[00000030h]		3_2_00ABC600
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ABC600 mov eax, dword ptr fs:[00000030h]		3_2_00ABC600
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AE8E00 mov eax, dword ptr fs:[00000030h]		3_2_00AE8E00
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEA61C mov eax, dword ptr fs:[00000030h]		3_2_00AEA61C
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AEA61C mov eax, dword ptr fs:[00000030h]		3_2_00AEA61C
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B71608 mov eax, dword ptr fs:[00000030h]		3_2_00B71608
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC766D mov eax, dword ptr fs:[00000030h]		3_2_00AC766D
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADAE73 mov eax, dword ptr fs:[00000030h]		3_2_00ADAE73
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADAE73 mov eax, dword ptr fs:[00000030h]		3_2_00ADAE73
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADAE73 mov eax, dword ptr fs:[00000030h]		3_2_00ADAE73
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADAE73 mov eax, dword ptr fs:[00000030h]		3_2_00ADAE73
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00ADAE73 mov eax, dword ptr fs:[00000030h]		3_2_00ADAE73
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC7E41 mov eax, dword ptr fs:[00000030h]		3_2_00AC7E41
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC7E41 mov eax, dword ptr fs:[00000030h]		3_2_00AC7E41
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC7E41 mov eax, dword ptr fs:[00000030h]		3_2_00AC7E41
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC7E41 mov eax, dword ptr fs:[00000030h]		3_2_00AC7E41
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC7E41 mov eax, dword ptr fs:[00000030h]		3_2_00AC7E41
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00AC7E41 mov eax, dword ptr fs:[00000030h]		3_2_00AC7E41
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7AE44 mov eax, dword ptr fs:[00000030h]		3_2_00B7AE44
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B7AE44 mov eax, dword ptr fs:[00000030h]		3_2_00B7AE44
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B37794 mov eax, dword ptr fs:[00000030h]		3_2_00B37794
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B37794 mov eax, dword ptr fs:[00000030h]		3_2_00B37794
Source: C:\Users\user\Desktop\cryptedprof.exe	Code function: 3_2_00B37794 mov eax, dword ptr fs:[00000030h]		3_2_00B37794
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04761074 mov eax, dword ptr fs:[00000030h]		7_2_04761074
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04752073 mov eax, dword ptr fs:[00000030h]		7_2_04752073
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B746D mov eax, dword ptr fs:[00000030h]		7_2_046B746D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0472C450 mov eax, dword ptr fs:[00000030h]		7_2_0472C450
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0472C450 mov eax, dword ptr fs:[00000030h]		7_2_0472C450
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046CA44B mov eax, dword ptr fs:[00000030h]		7_2_046CA44B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B0050 mov eax, dword ptr fs:[00000030h]		7_2_046B0050
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B0050 mov eax, dword ptr fs:[00000030h]		7_2_046B0050
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046AB02A mov eax, dword ptr fs:[00000030h]		7_2_046AB02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046AB02A mov eax, dword ptr fs:[00000030h]		7_2_046AB02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046AB02A mov eax, dword ptr fs:[00000030h]		7_2_046AB02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046AB02A mov eax, dword ptr fs:[00000030h]		7_2_046AB02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046CBC2C mov eax, dword ptr fs:[00000030h]		7_2_046CBC2C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C002D mov eax, dword ptr fs:[00000030h]		7_2_046C002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C002D mov eax, dword ptr fs:[00000030h]		7_2_046C002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C002D mov eax, dword ptr fs:[00000030h]		7_2_046C002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C002D mov eax, dword ptr fs:[00000030h]		7_2_046C002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C002D mov eax, dword ptr fs:[00000030h]		7_2_046C002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04764015 mov eax, dword ptr fs:[00000030h]		7_2_04764015
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04764015 mov eax, dword ptr fs:[00000030h]		7_2_04764015
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04717016 mov eax, dword ptr fs:[00000030h]		7_2_04717016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04717016 mov eax, dword ptr fs:[00000030h]		7_2_04717016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04717016 mov eax, dword ptr fs:[00000030h]		7_2_04717016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04751C06 mov eax, dword ptr fs:[00000030h]		7_2_04751C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0476740D mov eax, dword ptr fs:[00000030h]		7_2_0476740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0476740D mov eax, dword ptr fs:[00000030h]		7_2_0476740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0476740D mov eax, dword ptr fs:[00000030h]		7_2_0476740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716C0A mov eax, dword ptr fs:[00000030h]		7_2_04716C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716C0A mov eax, dword ptr fs:[00000030h]		7_2_04716C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716C0A mov eax, dword ptr fs:[00000030h]		7_2_04716C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716C0A mov eax, dword ptr fs:[00000030h]		7_2_04716C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716CF0 mov eax, dword ptr fs:[00000030h]		7_2_04716CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716CF0 mov eax, dword ptr fs:[00000030h]		7_2_04716CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716CF0 mov eax, dword ptr fs:[00000030h]		7_2_04716CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046958EC mov eax, dword ptr fs:[00000030h]		7_2_046958EC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047514FB mov eax, dword ptr fs:[00000030h]		7_2_047514FB
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04768CD6 mov eax, dword ptr fs:[00000030h]		7_2_04768CD6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0472B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0472B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0472B8D0 mov ecx, dword ptr fs:[00000030h]		7_2_0472B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0472B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0472B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0472B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0472B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0472B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0472B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0472B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0472B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D90AF mov eax, dword ptr fs:[00000030h]		7_2_046D90AF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C20A0 mov eax, dword ptr fs:[00000030h]		7_2_046C20A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C20A0 mov eax, dword ptr fs:[00000030h]		7_2_046C20A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C20A0 mov eax, dword ptr fs:[00000030h]		7_2_046C20A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C20A0 mov eax, dword ptr fs:[00000030h]		7_2_046C20A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C20A0 mov eax, dword ptr fs:[00000030h]		7_2_046C20A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C20A0 mov eax, dword ptr fs:[00000030h]		7_2_046C20A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046CF0BF mov ecx, dword ptr fs:[00000030h]		7_2_046CF0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046CF0BF mov eax, dword ptr fs:[00000030h]		7_2_046CF0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046CF0BF mov eax, dword ptr fs:[00000030h]		7_2_046CF0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04699080 mov eax, dword ptr fs:[00000030h]		7_2_04699080
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A849B mov eax, dword ptr fs:[00000030h]		7_2_046A849B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04713884 mov eax, dword ptr fs:[00000030h]		7_2_04713884
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04713884 mov eax, dword ptr fs:[00000030h]		7_2_04713884
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0469C962 mov eax, dword ptr fs:[00000030h]		7_2_0469C962
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0469B171 mov eax, dword ptr fs:[00000030h]		7_2_0469B171
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0469B171 mov eax, dword ptr fs:[00000030h]		7_2_0469B171
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046BC577 mov eax, dword ptr fs:[00000030h]		7_2_046BC577
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046BC577 mov eax, dword ptr fs:[00000030h]		7_2_046BC577
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046D3D43 mov eax, dword ptr fs:[00000030h]		7_2_046D3D43
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046BB944 mov eax, dword ptr fs:[00000030h]		7_2_046BB944
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046BB944 mov eax, dword ptr fs:[00000030h]		7_2_046BB944
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04713540 mov eax, dword ptr fs:[00000030h]		7_2_04713540
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B7D50 mov eax, dword ptr fs:[00000030h]		7_2_046B7D50
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04768D34 mov eax, dword ptr fs:[00000030h]		7_2_04768D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0471A537 mov eax, dword ptr fs:[00000030h]		7_2_0471A537
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B4120 mov eax, dword ptr fs:[00000030h]		7_2_046B4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B4120 mov eax, dword ptr fs:[00000030h]		7_2_046B4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B4120 mov eax, dword ptr fs:[00000030h]		7_2_046B4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B4120 mov eax, dword ptr fs:[00000030h]		7_2_046B4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046B4120 mov ecx, dword ptr fs:[00000030h]		7_2_046B4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0475E539 mov eax, dword ptr fs:[00000030h]		7_2_0475E539
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C513A mov eax, dword ptr fs:[00000030h]		7_2_046C513A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C513A mov eax, dword ptr fs:[00000030h]		7_2_046C513A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C4D3B mov eax, dword ptr fs:[00000030h]		7_2_046C4D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C4D3B mov eax, dword ptr fs:[00000030h]		7_2_046C4D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C4D3B mov eax, dword ptr fs:[00000030h]		7_2_046C4D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0469AD30 mov eax, dword ptr fs:[00000030h]		7_2_0469AD30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046A3D34 mov eax, dword ptr fs:[00000030h]		7_2_046A3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04699100 mov eax, dword ptr fs:[00000030h]		7_2_04699100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04699100 mov eax, dword ptr fs:[00000030h]		7_2_04699100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04699100 mov eax, dword ptr fs:[00000030h]		7_2_04699100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04748DF1 mov eax, dword ptr fs:[00000030h]		7_2_04748DF1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0469B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0469B1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0469B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0469B1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0469B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0469B1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046AD5E0 mov eax, dword ptr fs:[00000030h]		7_2_046AD5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046AD5E0 mov eax, dword ptr fs:[00000030h]		7_2_046AD5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0475FDE2 mov eax, dword ptr fs:[00000030h]		7_2_0475FDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0475FDE2 mov eax, dword ptr fs:[00000030h]		7_2_0475FDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0475FDE2 mov eax, dword ptr fs:[00000030h]		7_2_0475FDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_0475FDE2 mov eax, dword ptr fs:[00000030h]		7_2_0475FDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047241E8 mov eax, dword ptr fs:[00000030h]		7_2_047241E8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716DC9 mov eax, dword ptr fs:[00000030h]		7_2_04716DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716DC9 mov eax, dword ptr fs:[00000030h]		7_2_04716DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716DC9 mov eax, dword ptr fs:[00000030h]		7_2_04716DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716DC9 mov ecx, dword ptr fs:[00000030h]		7_2_04716DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716DC9 mov eax, dword ptr fs:[00000030h]		7_2_04716DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04716DC9 mov eax, dword ptr fs:[00000030h]		7_2_04716DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C61A0 mov eax, dword ptr fs:[00000030h]		7_2_046C61A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C61A0 mov eax, dword ptr fs:[00000030h]		7_2_046C61A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C35A1 mov eax, dword ptr fs:[00000030h]		7_2_046C35A1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047151BE mov eax, dword ptr fs:[00000030h]		7_2_047151BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047151BE mov eax, dword ptr fs:[00000030h]		7_2_047151BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047151BE mov eax, dword ptr fs:[00000030h]		7_2_047151BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047151BE mov eax, dword ptr fs:[00000030h]		7_2_047151BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047169A6 mov eax, dword ptr fs:[00000030h]		7_2_047169A6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C1DB5 mov eax, dword ptr fs:[00000030h]		7_2_046C1DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C1DB5 mov eax, dword ptr fs:[00000030h]		7_2_046C1DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C1DB5 mov eax, dword ptr fs:[00000030h]		7_2_046C1DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047605AC mov eax, dword ptr fs:[00000030h]		7_2_047605AC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_047605AC mov eax, dword ptr fs:[00000030h]		7_2_047605AC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04692D8A mov eax, dword ptr fs:[00000030h]		7_2_04692D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04692D8A mov eax, dword ptr fs:[00000030h]		7_2_04692D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04692D8A mov eax, dword ptr fs:[00000030h]		7_2_04692D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04692D8A mov eax, dword ptr fs:[00000030h]		7_2_04692D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_04692D8A mov eax, dword ptr fs:[00000030h]		7_2_04692D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046CA185 mov eax, dword ptr fs:[00000030h]		7_2_046CA185
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046BC182 mov eax, dword ptr fs:[00000030h]		7_2_046BC182
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C2581 mov eax, dword ptr fs:[00000030h]		7_2_046C2581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C2581 mov eax, dword ptr fs:[00000030h]		7_2_046C2581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 7_2_046C2581 mov eax, dword ptr fs:[00000030h]		7_2_046C2581

Enables debug privileges

Source: C:\Users\user\Desktop\cryptedprof.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 111.221.46.49 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 168.206.81.138 80			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\cryptedprof.exe	Section loaded: unknown target: C:\Users\user\Desktop\cryptedprof.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\cryptedprof.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\cryptedprof.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\cryptedprof.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\cryptedprof.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\cryptedprof.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Users\user\Desktop\cryptedprof.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Thread register set: target process: 3440			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\cryptedprof.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\cryptedprof.exe

Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: 180000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\cryptedprof.exe	Process created: C:\Users\user\Desktop\cryptedprof.exe 'C:\Users\user\Desktop\cryptedprof.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\cryptedprof.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000005.00000000.351832152.00000000083EB000.00000004.00000001.sdmp, msdt.exe, 00000007.00000002.591709948.0000000002F20000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.338761645.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.591709948.0000000002F20000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.338761645.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.591709948.0000000002F20000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000005.00000000.338761645.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000007.00000002.591709948.0000000002F20000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query windows version

Source: C:\Users\user\Desktop\cryptedprof.exe

Code function: 1_2_00403486 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess,

1_2_00403486

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000001.332707459.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388099224.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.335904498.0000000002A60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388332854.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388307234.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.591652804.0000000002C60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.590578068.00000000003D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cryptedprof.exe.2a60000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cryptedprof.exe.2a60000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000001.332707459.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388099224.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.335904498.0000000002A60000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388332854.00000000009F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.388307234.00000000009C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.591652804.0000000002C60000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.590578068.00000000003D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cryptedprof.exe.2a60000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.cryptedprof.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.cryptedprof.exe.2a60000.5.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.cryptedprof.exe.400000.0.raw.unpack, type: UNPACKEDPE