Analysis Report 74ed218c_by_Libranalysis

AV Detection:

Found malware configuration

Source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp

Malware Configuration Extractor: FormBook {"C2 list": ["www.cats16.com/8u3b/"], "decoy": ["pipienta.com", "wisdomfest.net", "jenniferreich.com", "bigcanoehomesforless.com", "kayandbernard.com", "offerbuildingsecrets.com", "benleefoto.com", "contactlesssoftware.tech", "statenislandplumbing.info", "lifestylemedicineservices.com", "blazerplanning.com", "fnatic-skins.club", "effectivemarketinginc.com", "babyshopit.com", "2000deal.com", "k12paymentcemter.com", "spwakd.com", "lesreponses.com", "abundando.com", "hawkspremierfhc.com", "midwestmadeclothing.com", "kamuakuinisiapa.com", "swirlingheadjewelry.com", "donelys.com", "stiloksero.com", "hoangphucsolar.com", "gb-contracting.com", "girlboyfriends.com", "decadejam.com", "glassfullcoffee.com", "todoparaconstruccion.com", "anygivenrunday.com", "newgalaxyindia.com", "dahlonegaforless.com", "blue-light.tech", "web-evo.com", "armmotive.com", "mollysmulligan.com", "penislandbrewer.com", "wgrimao.com", "dxm-int.net", "sarmaayagroup.com", "timbraunmusician.com", "amazoncovid19tracer.com", "peaknband.com", "pyqxlz.com", "palomachurch.com", "surfboardwarehouse.net", "burundiacademyst.com", "pltcoin.com", "workinglifestyle.com", "vickybowskill.com", "ottawahomevalues.info", "jtrainterrain.com", "francescoiocca.com", "metallitypiercing.com", "lashsavings.com", "discjockeydelraybeach.com", "indicraftsvilla.com", "tbq.xyz", "arfjkacsgatfzbazpdth.com", "appsend.online", "cunerier.com", "orospucocuguatmaca.com"]}

Multi AV Scanner detection for submitted file

Source: 74ed218c_by_Libranalysis.exe

ReversingLabs: Detection: 13%

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.378047898.0000000001680000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.378002260.0000000001650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.594461458.0000000002880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.593997073.0000000002780000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341386451.00000000041C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.74ed218c_by_Libranalysis.exe.4261998.3.raw.unpack, type: UNPACKEDPE

Antivirus or Machine Learning detection for unpacked file

Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack

Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

Uses 32bit PE files

Source: 74ed218c_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 74ed218c_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.358213656.0000000007BA0000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 74ed218c_by_Libranalysis.exe, 00000003.00000002.378356516.00000000018BF000.00000040.00000001.sdmp, cmd.exe, 00000007.00000003.378745605.0000000002CD0000.00000004.00000001.sdmp
Source:	Binary string: cmd.pdbUGP source: 74ed218c_by_Libranalysis.exe, 00000003.00000003.376909835.0000000001361000.00000004.00000001.sdmp, cmd.exe, 00000007.00000002.593308926.00000000002A0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 74ed218c_by_Libranalysis.exe, cmd.exe
Source:	Binary string: cmd.pdb source: 74ed218c_by_Libranalysis.exe, 00000003.00000003.376909835.0000000001361000.00000004.00000001.sdmp, cmd.exe
Source:	Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.358213656.0000000007BA0000.00000002.00000001.sdmp

Spreading:

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B245C FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,		7_2_002B245C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B68BA FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,		7_2_002B68BA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002AB89C GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,		7_2_002AB89C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A85EA memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,		7_2_002A85EA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002C31DC FindFirstFileW,FindNextFileW,FindClose,		7_2_002C31DC

Software Vulnerabilities:

Found inlined nop instructions (likely shell or obfuscated code)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		1_2_0BA881B0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		1_2_0BA89288
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		1_2_0BA882DC
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		1_2_0BA89279
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h		1_2_0BA881A1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 4x nop then pop edi		3_2_0040C368
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 4x nop then pop esi		3_2_004157FE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 4x nop then pop edi		7_2_0278C368
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 4x nop then pop esi		7_2_027957FE

Networking:

Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)

Source: Traffic	Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49754 -> 166.62.10.48:80
Source: Traffic	Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49754 -> 166.62.10.48:80
Source: Traffic	Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.6:49754 -> 166.62.10.48:80

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: www.cats16.com/8u3b/

HTTP GET or POST without a user agent

Source: global traffic	HTTP traffic detected: GET /8u3b/?EzrxUr=ApmP+YWYCK6vLVfjcl0EWRKNz1AqTOP9eBXy99nVLHRI2g8p2qSHut9K1XPRX5z6HIA+7i/UvA==&0VMt8D=3fJTbJlpxpVT_2d0 HTTP/1.1Host: www.spwakd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /8u3b/?EzrxUr=PWNBDH2hPCb1us8Ao8B+54WayNfcYj50QVchuC7xNQJC497qOyaPHph0Z/JAkFEaPJmxv/9Dmg==&0VMt8D=3fJTbJlpxpVT_2d0 HTTP/1.1Host: www.arfjkacsgatfzbazpdth.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /8u3b/?EzrxUr=TE3r3Po/80I3A7BjdmOrtV2X1cXMdBXcsPlehNMo8xFrjXCGEx4PM+IgH3zoRtc5Tgzkp+uvDw==&0VMt8D=3fJTbJlpxpVT_2d0 HTTP/1.1Host: www.babyshopit.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /8u3b/?0VMt8D=3fJTbJlpxpVT_2d0&EzrxUr=QhGT3fvyIg/Tdu+peJX/18F82XojpghVKKtPaYcZWPnpiCRWL9VDuvxnUE1ISN8qX8wj4FmhpA== HTTP/1.1Host: www.pyqxlz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

IP address seen in connection with other malware

Source: Joe Sandbox View

IP Address: 23.227.38.74 23.227.38.74

Internet Provider seen in connection with other malware

Source: Joe Sandbox View	ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View	ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View	ASN Name: AS-TIERP-36024US AS-TIERP-36024US

Downloads files from webservers via HTTP

Source: global traffic	HTTP traffic detected: GET /8u3b/?EzrxUr=ApmP+YWYCK6vLVfjcl0EWRKNz1AqTOP9eBXy99nVLHRI2g8p2qSHut9K1XPRX5z6HIA+7i/UvA==&0VMt8D=3fJTbJlpxpVT_2d0 HTTP/1.1Host: www.spwakd.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /8u3b/?EzrxUr=PWNBDH2hPCb1us8Ao8B+54WayNfcYj50QVchuC7xNQJC497qOyaPHph0Z/JAkFEaPJmxv/9Dmg==&0VMt8D=3fJTbJlpxpVT_2d0 HTTP/1.1Host: www.arfjkacsgatfzbazpdth.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /8u3b/?EzrxUr=TE3r3Po/80I3A7BjdmOrtV2X1cXMdBXcsPlehNMo8xFrjXCGEx4PM+IgH3zoRtc5Tgzkp+uvDw==&0VMt8D=3fJTbJlpxpVT_2d0 HTTP/1.1Host: www.babyshopit.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic	HTTP traffic detected: GET /8u3b/?0VMt8D=3fJTbJlpxpVT_2d0&EzrxUr=QhGT3fvyIg/Tdu+peJX/18F82XojpghVKKtPaYcZWPnpiCRWL9VDuvxnUE1ISN8qX8wj4FmhpA== HTTP/1.1Host: www.pyqxlz.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Performs DNS lookups

Source: unknown

DNS traffic detected: queries for: www.amazoncovid19tracer.com

Tries to download or post to a non-existing HTTP route (HTTP/1.1 404 Not Found / 503 Service Unavailable)

Source: global traffic

HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.10.3Date: Mon, 03 May 2021 12:43:30 GMTContent-Type: text/htmlContent-Length: 169Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 20 62 67 63 6f 6c 6f 72 3d 22 77 68 69 74 65 22 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 30 2e 33 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body bgcolor="white"><center><h1>404 Not Found</h1></center><hr><center>nginx/1.10.3</center></body></html>

URLs found in memory or binary data

Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://fontfabrik.com
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340649422.00000000031C1000.00000004.00000001.sdmp	String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.341165696.000000000095C000.00000004.00000020.sdmp	String found in binary or memory: http://www.autoitscript.com/autoit3/J
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.364055555.000000000B1A6000.00000002.00000001.sdmp	String found in binary or memory: http://www.zhongyicts.com.cn
Source: 74ed218c_by_Libranalysis.exe	String found in binary or memory: https://github.com/unguest
Source: 74ed218c_by_Libranalysis.exe	String found in binary or memory: https://github.com/unguest9WinForms_RecursiveFormCreate5WinForms_SeeInnerExceptionGProperty
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Key, Mouse, Clipboard, Microphone and Screen Capturing:

Creates a DirectInput object (often for capturing keystrokes)

Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.338123907.00000000014AB000.00000004.00000020.sdmp

Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.378047898.0000000001680000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.378002260.0000000001650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.594461458.0000000002880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.593997073.0000000002780000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341386451.00000000041C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.74ed218c_by_Libranalysis.exe.4261998.3.raw.unpack, type: UNPACKEDPE

System Summary:

Malicious sample detected (through community Yara rule)

Source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.378047898.0000000001680000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.378047898.0000000001680000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.378002260.0000000001650000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.378002260.0000000001650000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.594461458.0000000002880000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.594461458.0000000002880000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.593997073.0000000002780000.00000040.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.593997073.0000000002780000.00000040.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.341386451.00000000041C9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.341386451.00000000041C9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.74ed218c_by_Libranalysis.exe.4261998.3.raw.unpack, type: UNPACKEDPE	Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.74ed218c_by_Libranalysis.exe.4261998.3.raw.unpack, type: UNPACKEDPE	Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group

Contains functionality to call native functions

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_004181B0 NtCreateFile,		3_2_004181B0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00418260 NtReadFile,		3_2_00418260
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_004182E0 NtClose,		3_2_004182E0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00418390 NtAllocateVirtualMemory,		3_2_00418390
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00418392 NtAllocateVirtualMemory,		3_2_00418392
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018099A0 NtCreateSection,LdrInitializeThunk,		3_2_018099A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809910 NtAdjustPrivilegesToken,LdrInitializeThunk,		3_2_01809910
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018098F0 NtReadVirtualMemory,LdrInitializeThunk,		3_2_018098F0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809840 NtDelayExecution,LdrInitializeThunk,		3_2_01809840
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809860 NtQuerySystemInformation,LdrInitializeThunk,		3_2_01809860
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809A00 NtProtectVirtualMemory,LdrInitializeThunk,		3_2_01809A00
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809A20 NtResumeThread,LdrInitializeThunk,		3_2_01809A20
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809A50 NtCreateFile,LdrInitializeThunk,		3_2_01809A50
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018095D0 NtClose,LdrInitializeThunk,		3_2_018095D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809540 NtReadFile,LdrInitializeThunk,		3_2_01809540
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809780 NtMapViewOfSection,LdrInitializeThunk,		3_2_01809780
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018097A0 NtUnmapViewOfSection,LdrInitializeThunk,		3_2_018097A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809FE0 NtCreateMutant,LdrInitializeThunk,		3_2_01809FE0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809710 NtQueryInformationToken,LdrInitializeThunk,		3_2_01809710
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018096E0 NtFreeVirtualMemory,LdrInitializeThunk,		3_2_018096E0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809660 NtAllocateVirtualMemory,LdrInitializeThunk,		3_2_01809660
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018099D0 NtCreateProcessEx,		3_2_018099D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809950 NtQueueApcThread,		3_2_01809950
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018098A0 NtWriteVirtualMemory,		3_2_018098A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809820 NtEnumerateKey,		3_2_01809820
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0180B040 NtSuspendThread,		3_2_0180B040
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0180A3B0 NtGetContextThread,		3_2_0180A3B0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809B00 NtSetValueKey,		3_2_01809B00
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809A80 NtOpenDirectoryObject,		3_2_01809A80
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809A10 NtQuerySection,		3_2_01809A10
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018095F0 NtQueryInformationFile,		3_2_018095F0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809520 NtWaitForSingleObject,		3_2_01809520
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0180AD30 NtSetContextThread,		3_2_0180AD30
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809560 NtWriteFile,		3_2_01809560
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0180A710 NtOpenProcessToken,		3_2_0180A710
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809730 NtQueryVirtualMemory,		3_2_01809730
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809760 NtOpenProcess,		3_2_01809760
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0180A770 NtOpenThread,		3_2_0180A770
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809770 NtSetInformationFile,		3_2_01809770
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018096D0 NtCreateKey,		3_2_018096D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809610 NtEnumerateValueKey,		3_2_01809610
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809650 NtQueryValueKey,		3_2_01809650
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01809670 NtQueryInformationProcess,		3_2_01809670
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002AB42E NtOpenThreadToken,NtOpenProcessToken,NtClose,		7_2_002AB42E
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A58A4 _setjmp3,NtQueryInformationProcess,NtSetInformationProcess,NtSetInformationProcess,longjmp,		7_2_002A58A4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A84BE NtQueryVolumeInformationFile,GetFileInformationByHandleEx,		7_2_002A84BE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002AB4F8 NtQueryInformationToken,NtQueryInformationToken,		7_2_002AB4F8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002AB4C0 NtQueryInformationToken,		7_2_002AB4C0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002C6D90 EnterCriticalSection,LeaveCriticalSection,fprintf,fflush,TryAcquireSRWLockExclusive,NtCancelSynchronousIoFile,ReleaseSRWLockExclusive,_get_osfhandle,FlushConsoleInputBuffer,		7_2_002C6D90
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002CB5E0 SetLastError,CreateDirectoryW,CreateFileW,RtlDosPathNameToNtPathName_U,memset,memcpy,memcpy,NtFsControlFile,RtlNtStatusToDosError,SetLastError,CloseHandle,RtlFreeHeap,RemoveDirectoryW,		7_2_002CB5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002C9AB4 NtSetInformationFile,		7_2_002C9AB4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A83F2 RtlDosPathNameToRelativeNtPathName_U_WithStatus,NtOpenFile,RtlReleaseRelativeName,RtlFreeUnicodeString,CloseHandle,DeleteFileW,GetLastError,		7_2_002A83F2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9A50 NtCreateFile,LdrInitializeThunk,		7_2_02ED9A50
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9860 NtQuerySystemInformation,LdrInitializeThunk,		7_2_02ED9860
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9840 NtDelayExecution,LdrInitializeThunk,		7_2_02ED9840
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED99A0 NtCreateSection,LdrInitializeThunk,		7_2_02ED99A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9910 NtAdjustPrivilegesToken,LdrInitializeThunk,		7_2_02ED9910
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED96E0 NtFreeVirtualMemory,LdrInitializeThunk,		7_2_02ED96E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED96D0 NtCreateKey,LdrInitializeThunk,		7_2_02ED96D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9FE0 NtCreateMutant,LdrInitializeThunk,		7_2_02ED9FE0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9780 NtMapViewOfSection,LdrInitializeThunk,		7_2_02ED9780
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9710 NtQueryInformationToken,LdrInitializeThunk,		7_2_02ED9710
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED95D0 NtClose,LdrInitializeThunk,		7_2_02ED95D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9540 NtReadFile,LdrInitializeThunk,		7_2_02ED9540
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9A80 NtOpenDirectoryObject,		7_2_02ED9A80
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9A20 NtResumeThread,		7_2_02ED9A20
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9A00 NtProtectVirtualMemory,		7_2_02ED9A00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9A10 NtQuerySection,		7_2_02ED9A10
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EDA3B0 NtGetContextThread,		7_2_02EDA3B0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9B00 NtSetValueKey,		7_2_02ED9B00
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED98F0 NtReadVirtualMemory,		7_2_02ED98F0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED98A0 NtWriteVirtualMemory,		7_2_02ED98A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EDB040 NtSuspendThread,		7_2_02EDB040
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9820 NtEnumerateKey,		7_2_02ED9820
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED99D0 NtCreateProcessEx,		7_2_02ED99D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9950 NtQueueApcThread,		7_2_02ED9950
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9660 NtAllocateVirtualMemory,		7_2_02ED9660
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9670 NtQueryInformationProcess,		7_2_02ED9670
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9650 NtQueryValueKey,		7_2_02ED9650
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9610 NtEnumerateValueKey,		7_2_02ED9610
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED97A0 NtUnmapViewOfSection,		7_2_02ED97A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9760 NtOpenProcess,		7_2_02ED9760
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EDA770 NtOpenThread,		7_2_02EDA770
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9770 NtSetInformationFile,		7_2_02ED9770
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9730 NtQueryVirtualMemory,		7_2_02ED9730
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EDA710 NtOpenProcessToken,		7_2_02EDA710
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED95F0 NtQueryInformationFile,		7_2_02ED95F0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9560 NtWriteFile,		7_2_02ED9560
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED9520 NtWaitForSingleObject,		7_2_02ED9520
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EDAD30 NtSetContextThread,		7_2_02EDAD30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02798260 NtReadFile,		7_2_02798260
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_027982E0 NtClose,		7_2_027982E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_027981B0 NtCreateFile,		7_2_027981B0

Contains functionality to communicate with device drivers

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 7_2_002B6550: memset,GetFileSecurityW,GetSecurityDescriptorOwner,??_V@YAXPAX@Z,memset,CreateFileW,DeviceIoControl,memcpy,CloseHandle,??_V@YAXPAX@Z,memset,??_V@YAXPAX@Z,FindClose,??_V@YAXPAX@Z,

7_2_002B6550

Contains functionality to launch a process as a different user

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 7_2_002B374E InitializeProcThreadAttributeList,UpdateProcThreadAttribute,memset,memset,GetStartupInfoW,lstrcmpW,CreateProcessW,CloseHandle,GetLastError,GetLastError,DeleteProcThreadAttributeList,_local_unwind4,CreateProcessAsUserW,GetLastError,CloseHandle,

7_2_002B374E

Detected potential crypto function

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_016C94A8		1_2_016C94A8
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_016CC148		1_2_016CC148
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_016CA758		1_2_016CA758
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA88A28		1_2_0BA88A28
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA878C0		1_2_0BA878C0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA81830		1_2_0BA81830
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA81D30		1_2_0BA81D30
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA863FA		1_2_0BA863FA
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA86228		1_2_0BA86228
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA86219		1_2_0BA86219
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA83249		1_2_0BA83249
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA83258		1_2_0BA83258
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA81820		1_2_0BA81820
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA80F95		1_2_0BA80F95
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA80FD0		1_2_0BA80FD0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA85E29		1_2_0BA85E29
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA85E38		1_2_0BA85E38
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA81D1F		1_2_0BA81D1F
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA83D61		1_2_0BA83D61
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA83D70		1_2_0BA83D70
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA8642D		1_2_0BA8642D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_0BA86450		1_2_0BA86450
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00401030		3_2_00401030
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041B944		3_2_0041B944
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041BB84		3_2_0041BB84
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00408C4B		3_2_00408C4B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00408C50		3_2_00408C50
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041BCF5		3_2_0041BCF5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041C5ED		3_2_0041C5ED
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00402D90		3_2_00402D90
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041B70F		3_2_0041B70F
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00402FB0		3_2_00402FB0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E4120		3_2_017E4120
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CF900		3_2_017CF900
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018920A8		3_2_018920A8
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA830		3_2_017EA830
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018928EC		3_2_018928EC
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881002		3_2_01881002
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0189E824		3_2_0189E824
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F20A0		3_2_017F20A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DB090		3_2_017DB090
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EAB40		3_2_017EAB40
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018803DA		3_2_018803DA
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188DBD2		3_2_0188DBD2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018723E3		3_2_018723E3
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01892B28		3_2_01892B28
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FABD8		3_2_017FABD8
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0186CB4F		3_2_0186CB4F
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FEBB0		3_2_017FEBB0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F138B		3_2_017F138B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018922AE		3_2_018922AE
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB236		3_2_017EB236
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0187FA2B		3_2_0187FA2B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882D82		3_2_01882D82
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018925DD		3_2_018925DD
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C0D20		3_2_017C0D20
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01892D07		3_2_01892D07
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DD5E0		3_2_017DD5E0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01891D55		3_2_01891D55
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2581		3_2_017F2581
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D841F		3_2_017D841F
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188D466		3_2_0188D466
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0189DFCE		3_2_0189DFCE
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01891FF1		3_2_01891FF1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E6E30		3_2_017E6E30
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01892EF7		3_2_01892EF7
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188D616		3_2_0188D616
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002AD803		7_2_002AD803
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002AE040		7_2_002AE040
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002C5CEA		7_2_002C5CEA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A48E6		7_2_002A48E6
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A9CF0		7_2_002A9CF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002C3506		7_2_002C3506
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B1969		7_2_002B1969
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B6550		7_2_002B6550
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A7190		7_2_002A7190
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002C31DC		7_2_002C31DC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A5226		7_2_002A5226
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002AFA30		7_2_002AFA30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A5E70		7_2_002A5E70
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A8AD7		7_2_002A8AD7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002ACB48		7_2_002ACB48
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002C6FF0		7_2_002C6FF0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B5FC8		7_2_002B5FC8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F622AE		7_2_02F622AE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBB236		7_2_02EBB236
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F4FA2B		7_2_02F4FA2B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F423E3		7_2_02F423E3
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F5DBD2		7_2_02F5DBD2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F503DA		7_2_02F503DA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ECABD8		7_2_02ECABD8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ECEBB0		7_2_02ECEBB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC138B		7_2_02EC138B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBAB40		7_2_02EBAB40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F3CB4F		7_2_02F3CB4F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F62B28		7_2_02F62B28
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F628EC		7_2_02F628EC
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC20A0		7_2_02EC20A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F620A8		7_2_02F620A8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EAB090		7_2_02EAB090
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F6E824		7_2_02F6E824
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA830		7_2_02EBA830
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F51002		7_2_02F51002
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EB99BF		7_2_02EB99BF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EB4120		7_2_02EB4120
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E9F900		7_2_02E9F900
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F62EF7		7_2_02F62EF7
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EB6E30		7_2_02EB6E30
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F5D616		7_2_02F5D616
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F61FF1		7_2_02F61FF1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F6DFCE		7_2_02F6DFCE
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54496		7_2_02F54496
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F5D466		7_2_02F5D466
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBB477		7_2_02EBB477
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EA841F		7_2_02EA841F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EAD5E0		7_2_02EAD5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F625DD		7_2_02F625DD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC2581		7_2_02EC2581
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F52D82		7_2_02F52D82
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F61D55		7_2_02F61D55
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E90D20		7_2_02E90D20
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F62D07		7_2_02F62D07
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_0279BB84		7_2_0279BB84
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_0279B944		7_2_0279B944
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02782FB0		7_2_02782FB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02788C50		7_2_02788C50
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02788C4B		7_2_02788C4B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_0279BCF5		7_2_0279BCF5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_0279C5ED		7_2_0279C5ED
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02782D90		7_2_02782D90

Found potential string decryption / allocating functions

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: String function: 017CB150 appears 136 times
Source: C:\Windows\SysWOW64\cmd.exe	Code function: String function: 02E9B150 appears 136 times

PE file contains strange resources

Source: 74ed218c_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 74ed218c_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 74ed218c_by_Libranalysis.exe	Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST

Sample file is different than original file name gathered from version info

Source: 74ed218c_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 74ed218c_by_Libranalysis.exe
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000003.333147033.000000000432A000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameDSASignature.dll@ vs 74ed218c_by_Libranalysis.exe
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340649422.00000000031C1000.00000004.00000001.sdmp	Binary or memory string: OriginalFilenameSimpleUI.dll( vs 74ed218c_by_Libranalysis.exe
Source: 74ed218c_by_Libranalysis.exe	Binary or memory string: OriginalFilename vs 74ed218c_by_Libranalysis.exe
Source: 74ed218c_by_Libranalysis.exe, 00000003.00000002.378205032.000000000173D000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenameCmd.Exej% vs 74ed218c_by_Libranalysis.exe
Source: 74ed218c_by_Libranalysis.exe, 00000003.00000002.378356516.00000000018BF000.00000040.00000001.sdmp	Binary or memory string: OriginalFilenamentdll.dllj% vs 74ed218c_by_Libranalysis.exe
Source: 74ed218c_by_Libranalysis.exe	Binary or memory string: OriginalFilenameIBuiltInPermission.exe6 vs 74ed218c_by_Libranalysis.exe

Uses 32bit PE files

Source: 74ed218c_by_Libranalysis.exe

Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE

Yara signature match

Source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.378047898.0000000001680000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.378047898.0000000001680000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.378002260.0000000001650000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.378002260.0000000001650000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.594461458.0000000002880000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.594461458.0000000002880000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.593997073.0000000002780000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.593997073.0000000002780000.00000040.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.341386451.00000000041C9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.341386451.00000000041C9000.00000004.00000001.sdmp, type: MEMORY	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.74ed218c_by_Libranalysis.exe.4261998.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.74ed218c_by_Libranalysis.exe.4261998.3.raw.unpack, type: UNPACKEDPE	Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research

PE file has an executable .text section which is very likely to contain packed code (zlib compression ratio < 0.3)

Source: 74ed218c_by_Libranalysis.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Classification label

Source: classification engine

Classification label: mal100.troj.evad.winEXE@7/1@13/5

Contains functionality for error logging

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 7_2_002AC5CA _get_osfhandle,GetConsoleScreenBufferInfo,WriteConsoleW,GetLastError,GetLastError,FormatMessageW,GetConsoleScreenBufferInfo,WriteConsoleW,GetStdHandle,FlushConsoleInputBuffer,GetConsoleMode,SetConsoleMode,_getch,SetConsoleMode,GetConsoleScreenBufferInfo,FillConsoleOutputCharacterW,SetConsoleCursorPosition,EnterCriticalSection,LeaveCriticalSection,exit,

7_2_002AC5CA

Contains functionality to check free disk space

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 7_2_002CA0D2 memset,GetDiskFreeSpaceExW,??_V@YAXPAX@Z,

7_2_002CA0D2

Creates files inside the user directory

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\74ed218c_by_Libranalysis.exe.log

Jump to behavior

Creates mutexes

Source: C:\Windows\System32\conhost.exe

Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5800:120:WilError_01

PE file has an executable .text section and no other executable section

Source: 74ed218c_by_Libranalysis.exe

Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ

Parts of this applications are using the .NET runtime (Probably coded in C#)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll

Jump to behavior

Reads software policies

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Reads the hosts file

Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior
Source: C:\Windows\explorer.exe	File read: C:\Windows\System32\drivers\etc\hosts			Jump to behavior

SQL strings found in memory and binary data

Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)

Sample is known by Antivirus

Source: 74ed218c_by_Libranalysis.exe

ReversingLabs: Detection: 13%

Spawns processes

Source: unknown	Process created: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe 'C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe'
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe
Source: C:\Windows\explorer.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\SysWOW64\cmd.exe
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe'
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe'			Jump to behavior

Uses an in-process (OLE) Automation server

Source: C:\Windows\explorer.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32

Jump to behavior

Uses Microsoft Silverlight

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

Jump to behavior

PE file contains a COM descriptor data directory

Source: 74ed218c_by_Libranalysis.exe

Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

Contains modern PE file flags such as dynamic base (ASLR) or NX

Source: 74ed218c_by_Libranalysis.exe

Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT

Binary contains paths to debug symbols

Source:	Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.358213656.0000000007BA0000.00000002.00000001.sdmp
Source:	Binary string: wntdll.pdbUGP source: 74ed218c_by_Libranalysis.exe, 00000003.00000002.378356516.00000000018BF000.00000040.00000001.sdmp, cmd.exe, 00000007.00000003.378745605.0000000002CD0000.00000004.00000001.sdmp
Source:	Binary string: cmd.pdbUGP source: 74ed218c_by_Libranalysis.exe, 00000003.00000003.376909835.0000000001361000.00000004.00000001.sdmp, cmd.exe, 00000007.00000002.593308926.00000000002A0000.00000040.00000001.sdmp
Source:	Binary string: wntdll.pdb source: 74ed218c_by_Libranalysis.exe, cmd.exe
Source:	Binary string: cmd.pdb source: 74ed218c_by_Libranalysis.exe, 00000003.00000003.376909835.0000000001361000.00000004.00000001.sdmp, cmd.exe
Source:	Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.358213656.0000000007BA0000.00000002.00000001.sdmp

Data Obfuscation:

Uses code obfuscation techniques (call, push, ret)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_00DD9485 push cs; ret		1_2_00DD9492
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_00DD8632 push 00000002h; ret		1_2_00DD8634
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 1_2_00DD94E5 push cs; iretd		1_2_00DD94E6
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00415AFB push eax; iretd		3_2_00415B02
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041B3F2 push eax; ret		3_2_0041B3F8
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041B3FB push eax; ret		3_2_0041B462
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041B3A5 push eax; ret		3_2_0041B3F8
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0041B45C push eax; ret		3_2_0041B462
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00414E3F push edx; retf		3_2_00414E4D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00415FF0 push es; iretd		3_2_00415FF1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00C094E5 push cs; iretd		3_2_00C094E6
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00C09485 push cs; ret		3_2_00C09492
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_00C08632 push 00000002h; ret		3_2_00C08634
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0181D0D1 push ecx; ret		3_2_0181D0E4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B76BD push ecx; ret		7_2_002B76D0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B76D1 push ecx; ret		7_2_002B76E4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EED0D1 push ecx; ret		7_2_02EED0E4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02795AFB push eax; iretd		7_2_02795B02
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_0279B3FB push eax; ret		7_2_0279B462
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_0279B3F2 push eax; ret		7_2_0279B3F8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_0279B3A5 push eax; ret		7_2_0279B3F8
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02794E3F push edx; retf		7_2_02794E4D
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02795FF0 push es; iretd		7_2_02795FF1
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_0279B45C push eax; ret		7_2_0279B462

Binary may include packed or encrypted code

Source: initial sample

Static PE information: section name: .text entropy: 7.92660309365

Hooking and other Techniques for Hiding and Protection:

Disables application error messsages (SetErrorMode)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process information set: NOOPENFILEERRORBOX			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX			Jump to behavior

Malware Analysis System Evasion:

Yara detected AntiVM3

Source: Yara match	File source: 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: 74ed218c_by_Libranalysis.exe PID: 6800, type: MEMORY

Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)

Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: SBIEDLL.DLL

Tries to detect virtualization through RDTSC time measurements

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 00000000004085E4 second address: 00000000004085EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	RDTSC instruction interceptor: First address: 000000000040896E second address: 0000000000408974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe	RDTSC instruction interceptor: First address: 00000000027885E4 second address: 00000000027885EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cmd.exe	RDTSC instruction interceptor: First address: 000000000278896E second address: 0000000002788974 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Code function: 3_2_004088A0 rdtsc

3_2_004088A0

Contains long sleeps (>= 3 min)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Thread delayed: delay time: 922337203685477

Jump to behavior

May sleep (evasive loops) to hinder dynamic analysis

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe TID: 6804	Thread sleep time: -104418s >= -30000s			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe TID: 6840	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Windows\explorer.exe TID: 6608	Thread sleep time: -50000s >= -30000s			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe TID: 5648	Thread sleep time: -54000s >= -30000s			Jump to behavior

Sample execution stops while process was sleeping (likely an evasion)

Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed
Source: C:\Windows\SysWOW64\cmd.exe	Last function: Thread delayed

Contains functionality to enumerate / list files inside a directory

Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B245C FindFirstFileW,FindClose,memcpy,_wcsnicmp,_wcsicmp,memmove,		7_2_002B245C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B68BA FindFirstFileExW,GetLastError,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapReAlloc,FindNextFileW,FindClose,GetLastError,FindClose,		7_2_002B68BA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002AB89C GetFileAttributesW,GetLastError,FindFirstFileW,GetLastError,FindClose,memset,??_V@YAXPAX@Z,FindNextFileW,SetLastError,??_V@YAXPAX@Z,GetLastError,FindClose,		7_2_002AB89C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002A85EA memset,FindFirstFileW,FindClose,FindFirstFileW,FindNextFileW,FindClose,??_V@YAXPAX@Z,GetLastError,SetFileAttributesW,_wcsnicmp,GetFullPathNameW,SetLastError,GetLastError,SetFileAttributesW,		7_2_002A85EA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002C31DC FindFirstFileW,FindNextFileW,FindClose,		7_2_002C31DC

Contains medium sleeps (>= 30s)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Thread delayed: delay time: 104418			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Thread delayed: delay time: 922337203685477			Jump to behavior

May try to detect the virtual machine to hinder analysis (VM artifact strings found in memory)

Source: explorer.exe, 00000005.00000000.359081322.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000005.00000000.359184889.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000005.00000000.358690880.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.354075377.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000002.610153304.00000000062E0000.00000004.00000001.sdmp	Binary or memory string: Hyper-V RAW%SystemRoot%\system32\mswsock.dllte
Source: explorer.exe, 00000005.00000000.354839640.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: VMWARE
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.354075377.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: explorer.exe, 00000005.00000000.359800071.0000000008540000.00000004.00000001.sdmp	Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.354839640.00000000063F6000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: vmware
Source: explorer.exe, 00000005.00000000.359081322.00000000083EB000.00000004.00000001.sdmp	Binary or memory string: VMware SATA CD00
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: 74ed218c_by_Libranalysis.exe, 00000001.00000002.340709877.0000000003215000.00000004.00000001.sdmp	Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000005.00000000.358690880.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000005.00000000.354075377.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000005.00000000.358690880.00000000082E2000.00000004.00000001.sdmp	Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000005.00000000.359184889.0000000008430000.00000004.00000001.sdmp	Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000005.00000000.354075377.0000000005D50000.00000002.00000001.sdmp	Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: explorer.exe, 00000005.00000000.341165696.000000000095C000.00000004.00000020.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G

Queries a list of all running processes

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Process information queried: ProcessInformation

Jump to behavior

Anti Debugging:

Checks if the current process is being debugged

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process queried: DebugPort			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process queried: DebugPort			Jump to behavior

Contains functionality for execution timing, often used to detect debuggers

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Code function: 3_2_004088A0 rdtsc

3_2_004088A0

Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Code function: 3_2_00409B10 LdrLoadDll,

3_2_00409B10

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 7_2_002C2258 IsDebuggerPresent,

7_2_002C2258

Contains functionality to read the PEB

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CB171 mov eax, dword ptr fs:[00000030h]		3_2_017CB171
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CB171 mov eax, dword ptr fs:[00000030h]		3_2_017CB171
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CC962 mov eax, dword ptr fs:[00000030h]		3_2_017CC962
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018469A6 mov eax, dword ptr fs:[00000030h]		3_2_018469A6
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018849A4 mov eax, dword ptr fs:[00000030h]		3_2_018849A4
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018849A4 mov eax, dword ptr fs:[00000030h]		3_2_018849A4
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018849A4 mov eax, dword ptr fs:[00000030h]		3_2_018849A4
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018849A4 mov eax, dword ptr fs:[00000030h]		3_2_018849A4
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB944 mov eax, dword ptr fs:[00000030h]		3_2_017EB944
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB944 mov eax, dword ptr fs:[00000030h]		3_2_017EB944
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018451BE mov eax, dword ptr fs:[00000030h]		3_2_018451BE
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018451BE mov eax, dword ptr fs:[00000030h]		3_2_018451BE
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018451BE mov eax, dword ptr fs:[00000030h]		3_2_018451BE
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018451BE mov eax, dword ptr fs:[00000030h]		3_2_018451BE
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F513A mov eax, dword ptr fs:[00000030h]		3_2_017F513A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F513A mov eax, dword ptr fs:[00000030h]		3_2_017F513A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E4120 mov eax, dword ptr fs:[00000030h]		3_2_017E4120
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E4120 mov eax, dword ptr fs:[00000030h]		3_2_017E4120
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E4120 mov eax, dword ptr fs:[00000030h]		3_2_017E4120
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E4120 mov eax, dword ptr fs:[00000030h]		3_2_017E4120
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E4120 mov ecx, dword ptr fs:[00000030h]		3_2_017E4120
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018541E8 mov eax, dword ptr fs:[00000030h]		3_2_018541E8
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C9100 mov eax, dword ptr fs:[00000030h]		3_2_017C9100
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C9100 mov eax, dword ptr fs:[00000030h]		3_2_017C9100
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C9100 mov eax, dword ptr fs:[00000030h]		3_2_017C9100
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CB1E1 mov eax, dword ptr fs:[00000030h]		3_2_017CB1E1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CB1E1 mov eax, dword ptr fs:[00000030h]		3_2_017CB1E1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CB1E1 mov eax, dword ptr fs:[00000030h]		3_2_017CB1E1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov ecx, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov ecx, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov eax, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov ecx, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov ecx, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov eax, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov ecx, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov ecx, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov eax, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov ecx, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov ecx, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E99BF mov eax, dword ptr fs:[00000030h]		3_2_017E99BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F61A0 mov eax, dword ptr fs:[00000030h]		3_2_017F61A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F61A0 mov eax, dword ptr fs:[00000030h]		3_2_017F61A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2990 mov eax, dword ptr fs:[00000030h]		3_2_017F2990
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FA185 mov eax, dword ptr fs:[00000030h]		3_2_017FA185
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EC182 mov eax, dword ptr fs:[00000030h]		3_2_017EC182
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01843884 mov eax, dword ptr fs:[00000030h]		3_2_01843884
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01843884 mov eax, dword ptr fs:[00000030h]		3_2_01843884
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E0050 mov eax, dword ptr fs:[00000030h]		3_2_017E0050
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E0050 mov eax, dword ptr fs:[00000030h]		3_2_017E0050
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018090AF mov eax, dword ptr fs:[00000030h]		3_2_018090AF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA830 mov eax, dword ptr fs:[00000030h]		3_2_017EA830
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA830 mov eax, dword ptr fs:[00000030h]		3_2_017EA830
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA830 mov eax, dword ptr fs:[00000030h]		3_2_017EA830
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA830 mov eax, dword ptr fs:[00000030h]		3_2_017EA830
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F002D mov eax, dword ptr fs:[00000030h]		3_2_017F002D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F002D mov eax, dword ptr fs:[00000030h]		3_2_017F002D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F002D mov eax, dword ptr fs:[00000030h]		3_2_017F002D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F002D mov eax, dword ptr fs:[00000030h]		3_2_017F002D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F002D mov eax, dword ptr fs:[00000030h]		3_2_017F002D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0185B8D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185B8D0 mov ecx, dword ptr fs:[00000030h]		3_2_0185B8D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0185B8D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0185B8D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0185B8D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185B8D0 mov eax, dword ptr fs:[00000030h]		3_2_0185B8D0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DB02A mov eax, dword ptr fs:[00000030h]		3_2_017DB02A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DB02A mov eax, dword ptr fs:[00000030h]		3_2_017DB02A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DB02A mov eax, dword ptr fs:[00000030h]		3_2_017DB02A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DB02A mov eax, dword ptr fs:[00000030h]		3_2_017DB02A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C58EC mov eax, dword ptr fs:[00000030h]		3_2_017C58EC
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01847016 mov eax, dword ptr fs:[00000030h]		3_2_01847016
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01847016 mov eax, dword ptr fs:[00000030h]		3_2_01847016
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01847016 mov eax, dword ptr fs:[00000030h]		3_2_01847016
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB8E4 mov eax, dword ptr fs:[00000030h]		3_2_017EB8E4
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB8E4 mov eax, dword ptr fs:[00000030h]		3_2_017EB8E4
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01894015 mov eax, dword ptr fs:[00000030h]		3_2_01894015
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01894015 mov eax, dword ptr fs:[00000030h]		3_2_01894015
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C40E1 mov eax, dword ptr fs:[00000030h]		3_2_017C40E1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C40E1 mov eax, dword ptr fs:[00000030h]		3_2_017C40E1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C40E1 mov eax, dword ptr fs:[00000030h]		3_2_017C40E1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FF0BF mov ecx, dword ptr fs:[00000030h]		3_2_017FF0BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FF0BF mov eax, dword ptr fs:[00000030h]		3_2_017FF0BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FF0BF mov eax, dword ptr fs:[00000030h]		3_2_017FF0BF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F20A0 mov eax, dword ptr fs:[00000030h]		3_2_017F20A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F20A0 mov eax, dword ptr fs:[00000030h]		3_2_017F20A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F20A0 mov eax, dword ptr fs:[00000030h]		3_2_017F20A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F20A0 mov eax, dword ptr fs:[00000030h]		3_2_017F20A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F20A0 mov eax, dword ptr fs:[00000030h]		3_2_017F20A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F20A0 mov eax, dword ptr fs:[00000030h]		3_2_017F20A0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882073 mov eax, dword ptr fs:[00000030h]		3_2_01882073
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C9080 mov eax, dword ptr fs:[00000030h]		3_2_017C9080
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01891074 mov eax, dword ptr fs:[00000030h]		3_2_01891074
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188138A mov eax, dword ptr fs:[00000030h]		3_2_0188138A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F3B7A mov eax, dword ptr fs:[00000030h]		3_2_017F3B7A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F3B7A mov eax, dword ptr fs:[00000030h]		3_2_017F3B7A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0187D380 mov ecx, dword ptr fs:[00000030h]		3_2_0187D380
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CDB60 mov ecx, dword ptr fs:[00000030h]		3_2_017CDB60
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CF358 mov eax, dword ptr fs:[00000030h]		3_2_017CF358
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01895BA5 mov eax, dword ptr fs:[00000030h]		3_2_01895BA5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CDB40 mov eax, dword ptr fs:[00000030h]		3_2_017CDB40
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018453CA mov eax, dword ptr fs:[00000030h]		3_2_018453CA
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018453CA mov eax, dword ptr fs:[00000030h]		3_2_018453CA
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018723E3 mov ecx, dword ptr fs:[00000030h]		3_2_018723E3
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018723E3 mov ecx, dword ptr fs:[00000030h]		3_2_018723E3
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018723E3 mov eax, dword ptr fs:[00000030h]		3_2_018723E3
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA309 mov eax, dword ptr fs:[00000030h]		3_2_017EA309
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188131B mov eax, dword ptr fs:[00000030h]		3_2_0188131B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EDBE9 mov eax, dword ptr fs:[00000030h]		3_2_017EDBE9
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F03E2 mov eax, dword ptr fs:[00000030h]		3_2_017F03E2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F03E2 mov eax, dword ptr fs:[00000030h]		3_2_017F03E2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F03E2 mov eax, dword ptr fs:[00000030h]		3_2_017F03E2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F03E2 mov eax, dword ptr fs:[00000030h]		3_2_017F03E2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F03E2 mov eax, dword ptr fs:[00000030h]		3_2_017F03E2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F03E2 mov eax, dword ptr fs:[00000030h]		3_2_017F03E2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01898B58 mov eax, dword ptr fs:[00000030h]		3_2_01898B58
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F4BAD mov eax, dword ptr fs:[00000030h]		3_2_017F4BAD
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F4BAD mov eax, dword ptr fs:[00000030h]		3_2_017F4BAD
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F4BAD mov eax, dword ptr fs:[00000030h]		3_2_017F4BAD
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2397 mov eax, dword ptr fs:[00000030h]		3_2_017F2397
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FB390 mov eax, dword ptr fs:[00000030h]		3_2_017FB390
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D1B8F mov eax, dword ptr fs:[00000030h]		3_2_017D1B8F
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D1B8F mov eax, dword ptr fs:[00000030h]		3_2_017D1B8F
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F138B mov eax, dword ptr fs:[00000030h]		3_2_017F138B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F138B mov eax, dword ptr fs:[00000030h]		3_2_017F138B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F138B mov eax, dword ptr fs:[00000030h]		3_2_017F138B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C9240 mov eax, dword ptr fs:[00000030h]		3_2_017C9240
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C9240 mov eax, dword ptr fs:[00000030h]		3_2_017C9240
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C9240 mov eax, dword ptr fs:[00000030h]		3_2_017C9240
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C9240 mov eax, dword ptr fs:[00000030h]		3_2_017C9240
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB236 mov eax, dword ptr fs:[00000030h]		3_2_017EB236
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB236 mov eax, dword ptr fs:[00000030h]		3_2_017EB236
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB236 mov eax, dword ptr fs:[00000030h]		3_2_017EB236
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB236 mov eax, dword ptr fs:[00000030h]		3_2_017EB236
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB236 mov eax, dword ptr fs:[00000030h]		3_2_017EB236
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB236 mov eax, dword ptr fs:[00000030h]		3_2_017EB236
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EA229 mov eax, dword ptr fs:[00000030h]		3_2_017EA229
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E3A1C mov eax, dword ptr fs:[00000030h]		3_2_017E3A1C
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884AEF mov eax, dword ptr fs:[00000030h]		3_2_01884AEF
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CAA16 mov eax, dword ptr fs:[00000030h]		3_2_017CAA16
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CAA16 mov eax, dword ptr fs:[00000030h]		3_2_017CAA16
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C5210 mov eax, dword ptr fs:[00000030h]		3_2_017C5210
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C5210 mov ecx, dword ptr fs:[00000030h]		3_2_017C5210
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C5210 mov eax, dword ptr fs:[00000030h]		3_2_017C5210
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C5210 mov eax, dword ptr fs:[00000030h]		3_2_017C5210
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D8A0A mov eax, dword ptr fs:[00000030h]		3_2_017D8A0A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2AE4 mov eax, dword ptr fs:[00000030h]		3_2_017F2AE4
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188AA16 mov eax, dword ptr fs:[00000030h]		3_2_0188AA16
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188AA16 mov eax, dword ptr fs:[00000030h]		3_2_0188AA16
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01804A2C mov eax, dword ptr fs:[00000030h]		3_2_01804A2C
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01804A2C mov eax, dword ptr fs:[00000030h]		3_2_01804A2C
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2ACB mov eax, dword ptr fs:[00000030h]		3_2_017F2ACB
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DAAB0 mov eax, dword ptr fs:[00000030h]		3_2_017DAAB0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DAAB0 mov eax, dword ptr fs:[00000030h]		3_2_017DAAB0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FFAB0 mov eax, dword ptr fs:[00000030h]		3_2_017FFAB0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01854257 mov eax, dword ptr fs:[00000030h]		3_2_01854257
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C52A5 mov eax, dword ptr fs:[00000030h]		3_2_017C52A5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C52A5 mov eax, dword ptr fs:[00000030h]		3_2_017C52A5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C52A5 mov eax, dword ptr fs:[00000030h]		3_2_017C52A5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C52A5 mov eax, dword ptr fs:[00000030h]		3_2_017C52A5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C52A5 mov eax, dword ptr fs:[00000030h]		3_2_017C52A5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188EA55 mov eax, dword ptr fs:[00000030h]		3_2_0188EA55
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0187B260 mov eax, dword ptr fs:[00000030h]		3_2_0187B260
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0187B260 mov eax, dword ptr fs:[00000030h]		3_2_0187B260
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FD294 mov eax, dword ptr fs:[00000030h]		3_2_017FD294
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FD294 mov eax, dword ptr fs:[00000030h]		3_2_017FD294
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01898A62 mov eax, dword ptr fs:[00000030h]		3_2_01898A62
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0180927A mov eax, dword ptr fs:[00000030h]		3_2_0180927A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EC577 mov eax, dword ptr fs:[00000030h]		3_2_017EC577
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EC577 mov eax, dword ptr fs:[00000030h]		3_2_017EC577
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882D82 mov eax, dword ptr fs:[00000030h]		3_2_01882D82
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882D82 mov eax, dword ptr fs:[00000030h]		3_2_01882D82
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882D82 mov eax, dword ptr fs:[00000030h]		3_2_01882D82
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882D82 mov eax, dword ptr fs:[00000030h]		3_2_01882D82
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882D82 mov eax, dword ptr fs:[00000030h]		3_2_01882D82
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882D82 mov eax, dword ptr fs:[00000030h]		3_2_01882D82
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01882D82 mov eax, dword ptr fs:[00000030h]		3_2_01882D82
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018905AC mov eax, dword ptr fs:[00000030h]		3_2_018905AC
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018905AC mov eax, dword ptr fs:[00000030h]		3_2_018905AC
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E7D50 mov eax, dword ptr fs:[00000030h]		3_2_017E7D50
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F4D3B mov eax, dword ptr fs:[00000030h]		3_2_017F4D3B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F4D3B mov eax, dword ptr fs:[00000030h]		3_2_017F4D3B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F4D3B mov eax, dword ptr fs:[00000030h]		3_2_017F4D3B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D3D34 mov eax, dword ptr fs:[00000030h]		3_2_017D3D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CAD30 mov eax, dword ptr fs:[00000030h]		3_2_017CAD30
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846DC9 mov eax, dword ptr fs:[00000030h]		3_2_01846DC9
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846DC9 mov eax, dword ptr fs:[00000030h]		3_2_01846DC9
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846DC9 mov eax, dword ptr fs:[00000030h]		3_2_01846DC9
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846DC9 mov ecx, dword ptr fs:[00000030h]		3_2_01846DC9
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846DC9 mov eax, dword ptr fs:[00000030h]		3_2_01846DC9
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846DC9 mov eax, dword ptr fs:[00000030h]		3_2_01846DC9
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188FDE2 mov eax, dword ptr fs:[00000030h]		3_2_0188FDE2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188FDE2 mov eax, dword ptr fs:[00000030h]		3_2_0188FDE2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188FDE2 mov eax, dword ptr fs:[00000030h]		3_2_0188FDE2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188FDE2 mov eax, dword ptr fs:[00000030h]		3_2_0188FDE2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01878DF1 mov eax, dword ptr fs:[00000030h]		3_2_01878DF1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DD5E0 mov eax, dword ptr fs:[00000030h]		3_2_017DD5E0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DD5E0 mov eax, dword ptr fs:[00000030h]		3_2_017DD5E0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188E539 mov eax, dword ptr fs:[00000030h]		3_2_0188E539
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0184A537 mov eax, dword ptr fs:[00000030h]		3_2_0184A537
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01898D34 mov eax, dword ptr fs:[00000030h]		3_2_01898D34
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01803D43 mov eax, dword ptr fs:[00000030h]		3_2_01803D43
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01843540 mov eax, dword ptr fs:[00000030h]		3_2_01843540
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01873D40 mov eax, dword ptr fs:[00000030h]		3_2_01873D40
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F1DB5 mov eax, dword ptr fs:[00000030h]		3_2_017F1DB5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F1DB5 mov eax, dword ptr fs:[00000030h]		3_2_017F1DB5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F1DB5 mov eax, dword ptr fs:[00000030h]		3_2_017F1DB5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F35A1 mov eax, dword ptr fs:[00000030h]		3_2_017F35A1
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FFD9B mov eax, dword ptr fs:[00000030h]		3_2_017FFD9B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FFD9B mov eax, dword ptr fs:[00000030h]		3_2_017FFD9B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C2D8A mov eax, dword ptr fs:[00000030h]		3_2_017C2D8A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C2D8A mov eax, dword ptr fs:[00000030h]		3_2_017C2D8A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C2D8A mov eax, dword ptr fs:[00000030h]		3_2_017C2D8A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C2D8A mov eax, dword ptr fs:[00000030h]		3_2_017C2D8A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C2D8A mov eax, dword ptr fs:[00000030h]		3_2_017C2D8A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2581 mov eax, dword ptr fs:[00000030h]		3_2_017F2581
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2581 mov eax, dword ptr fs:[00000030h]		3_2_017F2581
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2581 mov eax, dword ptr fs:[00000030h]		3_2_017F2581
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F2581 mov eax, dword ptr fs:[00000030h]		3_2_017F2581
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FAC7B mov eax, dword ptr fs:[00000030h]		3_2_017FAC7B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB477 mov eax, dword ptr fs:[00000030h]		3_2_017EB477
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017E746D mov eax, dword ptr fs:[00000030h]		3_2_017E746D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01884496 mov eax, dword ptr fs:[00000030h]		3_2_01884496
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FA44B mov eax, dword ptr fs:[00000030h]		3_2_017FA44B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FBC2C mov eax, dword ptr fs:[00000030h]		3_2_017FBC2C
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01898CD6 mov eax, dword ptr fs:[00000030h]		3_2_01898CD6
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018814FB mov eax, dword ptr fs:[00000030h]		3_2_018814FB
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846CF0 mov eax, dword ptr fs:[00000030h]		3_2_01846CF0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846CF0 mov eax, dword ptr fs:[00000030h]		3_2_01846CF0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846CF0 mov eax, dword ptr fs:[00000030h]		3_2_01846CF0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0189740D mov eax, dword ptr fs:[00000030h]		3_2_0189740D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0189740D mov eax, dword ptr fs:[00000030h]		3_2_0189740D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0189740D mov eax, dword ptr fs:[00000030h]		3_2_0189740D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881C06 mov eax, dword ptr fs:[00000030h]		3_2_01881C06
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846C0A mov eax, dword ptr fs:[00000030h]		3_2_01846C0A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846C0A mov eax, dword ptr fs:[00000030h]		3_2_01846C0A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846C0A mov eax, dword ptr fs:[00000030h]		3_2_01846C0A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01846C0A mov eax, dword ptr fs:[00000030h]		3_2_01846C0A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185C450 mov eax, dword ptr fs:[00000030h]		3_2_0185C450
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185C450 mov eax, dword ptr fs:[00000030h]		3_2_0185C450
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D849B mov eax, dword ptr fs:[00000030h]		3_2_017D849B
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01847794 mov eax, dword ptr fs:[00000030h]		3_2_01847794
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01847794 mov eax, dword ptr fs:[00000030h]		3_2_01847794
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01847794 mov eax, dword ptr fs:[00000030h]		3_2_01847794
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DFF60 mov eax, dword ptr fs:[00000030h]		3_2_017DFF60
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017DEF40 mov eax, dword ptr fs:[00000030h]		3_2_017DEF40
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB73D mov eax, dword ptr fs:[00000030h]		3_2_017EB73D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EB73D mov eax, dword ptr fs:[00000030h]		3_2_017EB73D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FE730 mov eax, dword ptr fs:[00000030h]		3_2_017FE730
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C4F2E mov eax, dword ptr fs:[00000030h]		3_2_017C4F2E
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017C4F2E mov eax, dword ptr fs:[00000030h]		3_2_017C4F2E
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EF716 mov eax, dword ptr fs:[00000030h]		3_2_017EF716
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FA70E mov eax, dword ptr fs:[00000030h]		3_2_017FA70E
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FA70E mov eax, dword ptr fs:[00000030h]		3_2_017FA70E
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018037F5 mov eax, dword ptr fs:[00000030h]		3_2_018037F5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0189070D mov eax, dword ptr fs:[00000030h]		3_2_0189070D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0189070D mov eax, dword ptr fs:[00000030h]		3_2_0189070D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185FF10 mov eax, dword ptr fs:[00000030h]		3_2_0185FF10
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185FF10 mov eax, dword ptr fs:[00000030h]		3_2_0185FF10
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01898F6A mov eax, dword ptr fs:[00000030h]		3_2_01898F6A
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D8794 mov eax, dword ptr fs:[00000030h]		3_2_017D8794
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0185FE87 mov eax, dword ptr fs:[00000030h]		3_2_0185FE87
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EAE73 mov eax, dword ptr fs:[00000030h]		3_2_017EAE73
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EAE73 mov eax, dword ptr fs:[00000030h]		3_2_017EAE73
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EAE73 mov eax, dword ptr fs:[00000030h]		3_2_017EAE73
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EAE73 mov eax, dword ptr fs:[00000030h]		3_2_017EAE73
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017EAE73 mov eax, dword ptr fs:[00000030h]		3_2_017EAE73
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D766D mov eax, dword ptr fs:[00000030h]		3_2_017D766D
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_018446A7 mov eax, dword ptr fs:[00000030h]		3_2_018446A7
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01890EA5 mov eax, dword ptr fs:[00000030h]		3_2_01890EA5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01890EA5 mov eax, dword ptr fs:[00000030h]		3_2_01890EA5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01890EA5 mov eax, dword ptr fs:[00000030h]		3_2_01890EA5
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D7E41 mov eax, dword ptr fs:[00000030h]		3_2_017D7E41
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D7E41 mov eax, dword ptr fs:[00000030h]		3_2_017D7E41
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D7E41 mov eax, dword ptr fs:[00000030h]		3_2_017D7E41
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D7E41 mov eax, dword ptr fs:[00000030h]		3_2_017D7E41
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D7E41 mov eax, dword ptr fs:[00000030h]		3_2_017D7E41
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D7E41 mov eax, dword ptr fs:[00000030h]		3_2_017D7E41
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01808EC7 mov eax, dword ptr fs:[00000030h]		3_2_01808EC7
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0187FEC0 mov eax, dword ptr fs:[00000030h]		3_2_0187FEC0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CE620 mov eax, dword ptr fs:[00000030h]		3_2_017CE620
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01898ED6 mov eax, dword ptr fs:[00000030h]		3_2_01898ED6
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FA61C mov eax, dword ptr fs:[00000030h]		3_2_017FA61C
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017FA61C mov eax, dword ptr fs:[00000030h]		3_2_017FA61C
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CC600 mov eax, dword ptr fs:[00000030h]		3_2_017CC600
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CC600 mov eax, dword ptr fs:[00000030h]		3_2_017CC600
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017CC600 mov eax, dword ptr fs:[00000030h]		3_2_017CC600
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F8E00 mov eax, dword ptr fs:[00000030h]		3_2_017F8E00
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_01881608 mov eax, dword ptr fs:[00000030h]		3_2_01881608
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F16E0 mov ecx, dword ptr fs:[00000030h]		3_2_017F16E0
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017D76E2 mov eax, dword ptr fs:[00000030h]		3_2_017D76E2
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_017F36CC mov eax, dword ptr fs:[00000030h]		3_2_017F36CC
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0187FE3F mov eax, dword ptr fs:[00000030h]		3_2_0187FE3F
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188AE44 mov eax, dword ptr fs:[00000030h]		3_2_0188AE44
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Code function: 3_2_0188AE44 mov eax, dword ptr fs:[00000030h]		3_2_0188AE44
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002CB5E0 mov eax, dword ptr fs:[00000030h]		7_2_002CB5E0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC2AE4 mov eax, dword ptr fs:[00000030h]		7_2_02EC2AE4
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F54AEF mov eax, dword ptr fs:[00000030h]		7_2_02F54AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC2ACB mov eax, dword ptr fs:[00000030h]		7_2_02EC2ACB
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E952A5 mov eax, dword ptr fs:[00000030h]		7_2_02E952A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E952A5 mov eax, dword ptr fs:[00000030h]		7_2_02E952A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E952A5 mov eax, dword ptr fs:[00000030h]		7_2_02E952A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E952A5 mov eax, dword ptr fs:[00000030h]		7_2_02E952A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E952A5 mov eax, dword ptr fs:[00000030h]		7_2_02E952A5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EAAAB0 mov eax, dword ptr fs:[00000030h]		7_2_02EAAAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EAAAB0 mov eax, dword ptr fs:[00000030h]		7_2_02EAAAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ECFAB0 mov eax, dword ptr fs:[00000030h]		7_2_02ECFAB0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ECD294 mov eax, dword ptr fs:[00000030h]		7_2_02ECD294
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ECD294 mov eax, dword ptr fs:[00000030h]		7_2_02ECD294
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F4B260 mov eax, dword ptr fs:[00000030h]		7_2_02F4B260
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F4B260 mov eax, dword ptr fs:[00000030h]		7_2_02F4B260
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F68A62 mov eax, dword ptr fs:[00000030h]		7_2_02F68A62
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED927A mov eax, dword ptr fs:[00000030h]		7_2_02ED927A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F5EA55 mov eax, dword ptr fs:[00000030h]		7_2_02F5EA55
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F24257 mov eax, dword ptr fs:[00000030h]		7_2_02F24257
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E99240 mov eax, dword ptr fs:[00000030h]		7_2_02E99240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E99240 mov eax, dword ptr fs:[00000030h]		7_2_02E99240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E99240 mov eax, dword ptr fs:[00000030h]		7_2_02E99240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E99240 mov eax, dword ptr fs:[00000030h]		7_2_02E99240
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED4A2C mov eax, dword ptr fs:[00000030h]		7_2_02ED4A2C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ED4A2C mov eax, dword ptr fs:[00000030h]		7_2_02ED4A2C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA229 mov eax, dword ptr fs:[00000030h]		7_2_02EBA229
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBB236 mov eax, dword ptr fs:[00000030h]		7_2_02EBB236
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBB236 mov eax, dword ptr fs:[00000030h]		7_2_02EBB236
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBB236 mov eax, dword ptr fs:[00000030h]		7_2_02EBB236
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBB236 mov eax, dword ptr fs:[00000030h]		7_2_02EBB236
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBB236 mov eax, dword ptr fs:[00000030h]		7_2_02EBB236
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBB236 mov eax, dword ptr fs:[00000030h]		7_2_02EBB236
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EA8A0A mov eax, dword ptr fs:[00000030h]		7_2_02EA8A0A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F5AA16 mov eax, dword ptr fs:[00000030h]		7_2_02F5AA16
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F5AA16 mov eax, dword ptr fs:[00000030h]		7_2_02F5AA16
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EB3A1C mov eax, dword ptr fs:[00000030h]		7_2_02EB3A1C
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E95210 mov eax, dword ptr fs:[00000030h]		7_2_02E95210
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E95210 mov ecx, dword ptr fs:[00000030h]		7_2_02E95210
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E95210 mov eax, dword ptr fs:[00000030h]		7_2_02E95210
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E95210 mov eax, dword ptr fs:[00000030h]		7_2_02E95210
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E9AA16 mov eax, dword ptr fs:[00000030h]		7_2_02E9AA16
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E9AA16 mov eax, dword ptr fs:[00000030h]		7_2_02E9AA16
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBDBE9 mov eax, dword ptr fs:[00000030h]		7_2_02EBDBE9
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC03E2 mov eax, dword ptr fs:[00000030h]		7_2_02EC03E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC03E2 mov eax, dword ptr fs:[00000030h]		7_2_02EC03E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC03E2 mov eax, dword ptr fs:[00000030h]		7_2_02EC03E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC03E2 mov eax, dword ptr fs:[00000030h]		7_2_02EC03E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC03E2 mov eax, dword ptr fs:[00000030h]		7_2_02EC03E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC03E2 mov eax, dword ptr fs:[00000030h]		7_2_02EC03E2
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F423E3 mov ecx, dword ptr fs:[00000030h]		7_2_02F423E3
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F423E3 mov ecx, dword ptr fs:[00000030h]		7_2_02F423E3
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F423E3 mov eax, dword ptr fs:[00000030h]		7_2_02F423E3
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F153CA mov eax, dword ptr fs:[00000030h]		7_2_02F153CA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F153CA mov eax, dword ptr fs:[00000030h]		7_2_02F153CA
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC4BAD mov eax, dword ptr fs:[00000030h]		7_2_02EC4BAD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC4BAD mov eax, dword ptr fs:[00000030h]		7_2_02EC4BAD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC4BAD mov eax, dword ptr fs:[00000030h]		7_2_02EC4BAD
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F65BA5 mov eax, dword ptr fs:[00000030h]		7_2_02F65BA5
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EA1B8F mov eax, dword ptr fs:[00000030h]		7_2_02EA1B8F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EA1B8F mov eax, dword ptr fs:[00000030h]		7_2_02EA1B8F
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC138B mov eax, dword ptr fs:[00000030h]		7_2_02EC138B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC138B mov eax, dword ptr fs:[00000030h]		7_2_02EC138B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC138B mov eax, dword ptr fs:[00000030h]		7_2_02EC138B
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F4D380 mov ecx, dword ptr fs:[00000030h]		7_2_02F4D380
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC2397 mov eax, dword ptr fs:[00000030h]		7_2_02EC2397
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02ECB390 mov eax, dword ptr fs:[00000030h]		7_2_02ECB390
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F5138A mov eax, dword ptr fs:[00000030h]		7_2_02F5138A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E9DB60 mov ecx, dword ptr fs:[00000030h]		7_2_02E9DB60
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC3B7A mov eax, dword ptr fs:[00000030h]		7_2_02EC3B7A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EC3B7A mov eax, dword ptr fs:[00000030h]		7_2_02EC3B7A
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E9DB40 mov eax, dword ptr fs:[00000030h]		7_2_02E9DB40
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02F68B58 mov eax, dword ptr fs:[00000030h]		7_2_02F68B58
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02E9F358 mov eax, dword ptr fs:[00000030h]		7_2_02E9F358
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_02EBA309 mov eax, dword ptr fs:[00000030h]		7_2_02EBA309

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 7_2_002AAC30 GetProcessHeap,RtlFreeHeap,GetProcessHeap,RtlFreeHeap,

7_2_002AAC30

Enables debug privileges

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process token adjusted: Debug			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process token adjusted: Debug			Jump to behavior

Contains functionality to register its own exception handler

Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B7310 SetUnhandledExceptionFilter,		7_2_002B7310
Source: C:\Windows\SysWOW64\cmd.exe	Code function: 7_2_002B6FE3 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess,		7_2_002B6FE3

Creates guard pages, often used to prevent reverse usering and debugging

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Memory allocated: page read and write | page guard

Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

System process connects to network (likely due to code injection or exploit)

Source: C:\Windows\explorer.exe	Network Connect: 103.5.116.132 80			Jump to behavior
Source: C:\Windows\explorer.exe	Network Connect: 23.227.38.74 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.cats16.com
Source: C:\Windows\explorer.exe	Domain query: www.babyshopit.com
Source: C:\Windows\explorer.exe	Domain query: www.amazoncovid19tracer.com
Source: C:\Windows\explorer.exe	Domain query: www.pyqxlz.com
Source: C:\Windows\explorer.exe	Network Connect: 34.102.136.180 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.jenniferreich.com
Source: C:\Windows\explorer.exe	Domain query: www.newgalaxyindia.com
Source: C:\Windows\explorer.exe	Network Connect: 95.217.117.42 80			Jump to behavior
Source: C:\Windows\explorer.exe	Domain query: www.spwakd.com
Source: C:\Windows\explorer.exe	Domain query: www.decadejam.com
Source: C:\Windows\explorer.exe	Domain query: www.kamuakuinisiapa.com
Source: C:\Windows\explorer.exe	Domain query: www.arfjkacsgatfzbazpdth.com
Source: C:\Windows\explorer.exe	Domain query: www.appsend.online
Source: C:\Windows\explorer.exe	Network Connect: 74.50.52.136 80			Jump to behavior

Injects a PE file into a foreign processes

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Memory written: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe base: 400000 value starts with: 4D5A

Jump to behavior

Maps a DLL or memory area into another process

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Section loaded: unknown target: C:\Windows\SysWOW64\cmd.exe protection: execute and read and write			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: read write			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write			Jump to behavior

Modifies the context of a thread in another process (thread injection)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Thread register set: target process: 3440			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Thread register set: target process: 3440			Jump to behavior

Queues an APC in another process (thread injection)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Thread APC queued: target process: C:\Windows\explorer.exe

Jump to behavior

Sample uses process hollowing technique

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Section unmapped: C:\Windows\SysWOW64\cmd.exe base address: 2A0000

Jump to behavior

Creates a process in suspended mode (likely to inject code)

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Process created: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe			Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe'			Jump to behavior

May try to detect the Windows Explorer process (often used for injection)

Source: explorer.exe, 00000005.00000002.608102907.0000000004F80000.00000004.00000001.sdmp, cmd.exe, 00000007.00000002.598403335.00000000056F0000.00000002.00000001.sdmp	Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.341069264.00000000008B8000.00000004.00000020.sdmp, cmd.exe, 00000007.00000002.598403335.00000000056F0000.00000002.00000001.sdmp	Binary or memory string: Progman
Source: explorer.exe, 00000005.00000002.595474178.0000000000EE0000.00000002.00000001.sdmp, cmd.exe, 00000007.00000002.598403335.00000000056F0000.00000002.00000001.sdmp	Binary or memory string: &Program Manager
Source: explorer.exe, 00000005.00000002.595474178.0000000000EE0000.00000002.00000001.sdmp, cmd.exe, 00000007.00000002.598403335.00000000056F0000.00000002.00000001.sdmp	Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

Contains functionality to query locales information (e.g. system language)

Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,memmove,GetTimeFormatW,		7_2_002A96A0
Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetSystemTime,SystemTimeToFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,GetLocaleInfoW,GetDateFormatW,memmove,GetDateFormatW,realloc,GetDateFormatW,memmove,GetLastError,GetLastError,realloc,		7_2_002A5AEF
Source: C:\Windows\SysWOW64\cmd.exe	Code function: GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,GetLocaleInfoW,setlocale,		7_2_002B3F80

Queries the volume information (name, serial number etc) of a device

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Queries volume information: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation			Jump to behavior
Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation			Jump to behavior

Contains functionality to query local / system time

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 7_2_002C3C49 GetSystemTime,SystemTimeToFileTime,

7_2_002C3C49

Contains functionality to query windows version

Source: C:\Windows\SysWOW64\cmd.exe

Code function: 7_2_002A443C GetVersion,

7_2_002A443C

Queries the cryptographic machine GUID

Source: C:\Users\user\Desktop\74ed218c_by_Libranalysis.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Jump to behavior

Stealing of Sensitive Information:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.378047898.0000000001680000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.378002260.0000000001650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.594461458.0000000002880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.593997073.0000000002780000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341386451.00000000041C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.74ed218c_by_Libranalysis.exe.4261998.3.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

Yara detected FormBook

Source: Yara match	File source: 00000003.00000002.377542690.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.378047898.0000000001680000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000002.378002260.0000000001650000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.594461458.0000000002880000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.593997073.0000000002780000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 00000001.00000002.341386451.00000000041C9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match	File source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 3.2.74ed218c_by_Libranalysis.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 1.2.74ed218c_by_Libranalysis.exe.4261998.3.raw.unpack, type: UNPACKEDPE