Analysis Report 202139769574 Shipping Documents.exe

Overview

General Information

Sample Name: 202139769574 Shipping Documents.exe
Analysis ID: 403523
MD5: eee5f618718bc8237bb9c7a48154cf1a
SHA1: 84dc873f65dc9e86978944d1adddb762efcf2631
SHA256: cc7b066e0fa912d406c27790458ad6feb171b27275b6e3fe46b7a7574da7bfce
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Executable has a suspicious name (potential lure to open the executable)
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.magnumopuspro.com/nyr/"], "decoy": ["anemone-vintage.com", "ironcitytools.com", "joshandmatthew.com", "breathtakingscenery.photos", "karabakh-terror.com", "micahelgall.com", "entretiendesterrasses.com", "mhgholdings.com", "blewm.com", "sidewalknotary.com", "ytrs-elec.com", "danhpham.com", "ma21cle2henz.xyz", "lotusforlease.com", "shipleyphotoandfilm.com", "bulktool.xyz", "ouedzmala.com", "yichengvpr.com", "connectmygames.com", "chjcsc.com", "dope-chocolate.com", "tacowench.com", "projectsbay.com", "xn--pgboc92d.com", "royaldropofoil.com", "ranguanglian.club", "mobilne-kucice.com", "buytsycon.com", "goiasbets.net", "blpetroleum.com", "starrealms.net", "exclusiveflooringcollection.com", "kudalive.com", "tienda-sky.com", "drillinginsider.info", "theglasshousenyc.com", "vietnammoi.xyz", "walterbenicio.com", "zoomtvliveshows.xyz", "boujiehoodbaby.com", "yzyangyu.com", "exploreecetera.com", "sycord.com", "waykifood.com", "shadingconsultancy.com", "precedentai.net", "linhanhkitchen.com", "expekt24.com", "socialdating24.com", "lubvim.com", "floryi.com", "alerist.com", "maluss.com", "hitbbq.com", "alerrandrotattoo.com", "algoplayer.com", "idahooutsiders.com", "qygmuakhk.club", "neverpossible.com", "winparadigm.com", "toughdecorative.com", "yourbuildmedia.com", "summercrowd.com", "josemvazquez.com"]}
Multi AV Scanner detection for submitted file
Source: 202139769574 Shipping Documents.exe Virustotal: Detection: 33% Perma Link
Source: 202139769574 Shipping Documents.exe ReversingLabs: Detection: 31%
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.657714825.0000000003070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.698729438.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.700421859.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907951301.0000000000C80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907352431.0000000000470000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.650273193.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907896289.0000000000A20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.1.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.202139769574 Shipping Documents.exe.3070000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: 202139769574 Shipping Documents.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: 202139769574 Shipping Documents.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: 202139769574 Shipping Documents.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.671162738.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: 202139769574 Shipping Documents.exe, 00000001.00000003.646868549.0000000003230000.00000004.00000001.sdmp, 202139769574 Shipping Documents.exe, 00000002.00000002.700767024.0000000000A90000.00000040.00000001.sdmp, mstsc.exe, 00000007.00000002.909918766.00000000047C0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 202139769574 Shipping Documents.exe, mstsc.exe
Source: Binary string: mstsc.pdbGCTL source: 202139769574 Shipping Documents.exe, 00000002.00000002.701928540.0000000002700000.00000040.00000001.sdmp
Source: Binary string: mstsc.pdb source: 202139769574 Shipping Documents.exe, 00000002.00000002.701928540.0000000002700000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.671162738.0000000005A00000.00000002.00000001.sdmp
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 1_2_004059F0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_0040659C FindFirstFileA,FindClose, 1_2_0040659C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_004027A1 FindFirstFileA, 1_2_004027A1

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 4x nop then pop esi 2_2_004172F1
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 4x nop then pop edi 2_2_0040E429
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop esi 7_2_004872F1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 4x nop then pop edi 7_2_0047E429

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.magnumopuspro.com/nyr/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /nyr/?tVZl=MKniHD/KKNZ944A0QkseLq559MRPs5jQaAqVav9SZ3PAwf03LQBPNZ+ImXhjCplVxvzR&U4kp=NtxHhLZ8S6kT5jw HTTP/1.1Host: www.maluss.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nyr/?tVZl=EDKKYtZbbvwE4Q/e7xe/ld4gtfmRUWoVn+FtgOYbXYxqqFBCU6VSMnG1GKc/0KEvkVST&U4kp=NtxHhLZ8S6kT5jw HTTP/1.1Host: www.exclusiveflooringcollection.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 198.185.159.144 198.185.159.144
Source: Joe Sandbox View IP Address: 23.227.38.74 23.227.38.74
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: global traffic HTTP traffic detected: GET /nyr/?tVZl=MKniHD/KKNZ944A0QkseLq559MRPs5jQaAqVav9SZ3PAwf03LQBPNZ+ImXhjCplVxvzR&U4kp=NtxHhLZ8S6kT5jw HTTP/1.1Host: www.maluss.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nyr/?tVZl=EDKKYtZbbvwE4Q/e7xe/ld4gtfmRUWoVn+FtgOYbXYxqqFBCU6VSMnG1GKc/0KEvkVST&U4kp=NtxHhLZ8S6kT5jw HTTP/1.1Host: www.exclusiveflooringcollection.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.magnumopuspro.com
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: 202139769574 Shipping Documents.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: 202139769574 Shipping Documents.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000002.909702700.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000004.00000000.684148917.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_0040548D GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_0040548D

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.657714825.0000000003070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.698729438.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.700421859.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907951301.0000000000C80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907352431.0000000000470000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.650273193.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907896289.0000000000A20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.1.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.202139769574 Shipping Documents.exe.3070000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.657714825.0000000003070000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.657714825.0000000003070000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.698729438.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.698729438.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.700421859.00000000009D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.700421859.00000000009D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.907951301.0000000000C80000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.907951301.0000000000C80000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.907352431.0000000000470000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.907352431.0000000000470000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000001.650273193.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000001.650273193.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000002.907896289.0000000000A20000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000002.907896289.0000000000A20000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Executable has a suspicious name (potential lure to open the executable)
Source: 202139769574 Shipping Documents.exe Static file information: Suspicious name
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: 202139769574 Shipping Documents.exe
Contains functionality to call native functions
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00419D60 NtCreateFile, 2_2_00419D60
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00419E10 NtReadFile, 2_2_00419E10
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00419E90 NtClose, 2_2_00419E90
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00419F40 NtAllocateVirtualMemory, 2_2_00419F40
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00419D5A NtCreateFile, 2_2_00419D5A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF98F0 NtReadVirtualMemory,LdrInitializeThunk, 2_2_00AF98F0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9860 NtQuerySystemInformation,LdrInitializeThunk, 2_2_00AF9860
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9840 NtDelayExecution,LdrInitializeThunk, 2_2_00AF9840
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF99A0 NtCreateSection,LdrInitializeThunk, 2_2_00AF99A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 2_2_00AF9910
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9A20 NtResumeThread,LdrInitializeThunk, 2_2_00AF9A20
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9A00 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_00AF9A00
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9A50 NtCreateFile,LdrInitializeThunk, 2_2_00AF9A50
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF95D0 NtClose,LdrInitializeThunk, 2_2_00AF95D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9540 NtReadFile,LdrInitializeThunk, 2_2_00AF9540
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF96E0 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_00AF96E0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9660 NtAllocateVirtualMemory,LdrInitializeThunk, 2_2_00AF9660
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF97A0 NtUnmapViewOfSection,LdrInitializeThunk, 2_2_00AF97A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9780 NtMapViewOfSection,LdrInitializeThunk, 2_2_00AF9780
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9710 NtQueryInformationToken,LdrInitializeThunk, 2_2_00AF9710
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF98A0 NtWriteVirtualMemory, 2_2_00AF98A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9820 NtEnumerateKey, 2_2_00AF9820
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AFB040 NtSuspendThread, 2_2_00AFB040
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF99D0 NtCreateProcessEx, 2_2_00AF99D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9950 NtQueueApcThread, 2_2_00AF9950
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9A80 NtOpenDirectoryObject, 2_2_00AF9A80
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9A10 NtQuerySection, 2_2_00AF9A10
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AFA3B0 NtGetContextThread, 2_2_00AFA3B0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9B00 NtSetValueKey, 2_2_00AF9B00
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF95F0 NtQueryInformationFile, 2_2_00AF95F0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9520 NtWaitForSingleObject, 2_2_00AF9520
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AFAD30 NtSetContextThread, 2_2_00AFAD30
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9560 NtWriteFile, 2_2_00AF9560
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF96D0 NtCreateKey, 2_2_00AF96D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9610 NtEnumerateValueKey, 2_2_00AF9610
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9670 NtQueryInformationProcess, 2_2_00AF9670
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9650 NtQueryValueKey, 2_2_00AF9650
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9FE0 NtCreateMutant, 2_2_00AF9FE0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9730 NtQueryVirtualMemory, 2_2_00AF9730
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AFA710 NtOpenProcessToken, 2_2_00AFA710
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9760 NtOpenProcess, 2_2_00AF9760
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF9770 NtSetInformationFile, 2_2_00AF9770
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AFA770 NtOpenThread, 2_2_00AFA770
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829840 NtDelayExecution,LdrInitializeThunk, 7_2_04829840
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829860 NtQuerySystemInformation,LdrInitializeThunk, 7_2_04829860
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048299A0 NtCreateSection,LdrInitializeThunk, 7_2_048299A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048295D0 NtClose,LdrInitializeThunk, 7_2_048295D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829910 NtAdjustPrivilegesToken,LdrInitializeThunk, 7_2_04829910
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829540 NtReadFile,LdrInitializeThunk, 7_2_04829540
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048296D0 NtCreateKey,LdrInitializeThunk, 7_2_048296D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048296E0 NtFreeVirtualMemory,LdrInitializeThunk, 7_2_048296E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829650 NtQueryValueKey,LdrInitializeThunk, 7_2_04829650
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829A50 NtCreateFile,LdrInitializeThunk, 7_2_04829A50
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829660 NtAllocateVirtualMemory,LdrInitializeThunk, 7_2_04829660
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829780 NtMapViewOfSection,LdrInitializeThunk, 7_2_04829780
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829FE0 NtCreateMutant,LdrInitializeThunk, 7_2_04829FE0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829710 NtQueryInformationToken,LdrInitializeThunk, 7_2_04829710
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048298A0 NtWriteVirtualMemory, 7_2_048298A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048298F0 NtReadVirtualMemory, 7_2_048298F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829820 NtEnumerateKey, 7_2_04829820
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0482B040 NtSuspendThread, 7_2_0482B040
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048299D0 NtCreateProcessEx, 7_2_048299D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048295F0 NtQueryInformationFile, 7_2_048295F0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829520 NtWaitForSingleObject, 7_2_04829520
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0482AD30 NtSetContextThread, 7_2_0482AD30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829950 NtQueueApcThread, 7_2_04829950
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829560 NtWriteFile, 7_2_04829560
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829A80 NtOpenDirectoryObject, 7_2_04829A80
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829A00 NtProtectVirtualMemory, 7_2_04829A00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829610 NtEnumerateValueKey, 7_2_04829610
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829A10 NtQuerySection, 7_2_04829A10
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829A20 NtResumeThread, 7_2_04829A20
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829670 NtQueryInformationProcess, 7_2_04829670
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048297A0 NtUnmapViewOfSection, 7_2_048297A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0482A3B0 NtGetContextThread, 7_2_0482A3B0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829B00 NtSetValueKey, 7_2_04829B00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0482A710 NtOpenProcessToken, 7_2_0482A710
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829730 NtQueryVirtualMemory, 7_2_04829730
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829760 NtOpenProcess, 7_2_04829760
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04829770 NtSetInformationFile, 7_2_04829770
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0482A770 NtOpenThread, 7_2_0482A770
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00489D60 NtCreateFile, 7_2_00489D60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00489E10 NtReadFile, 7_2_00489E10
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00489E90 NtClose, 7_2_00489E90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00489F40 NtAllocateVirtualMemory, 7_2_00489F40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00489D5A NtCreateFile, 7_2_00489D5A
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403461
Detected potential crypto function
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_00406925 1_2_00406925
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041E853 2_2_0041E853
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041D07C 2_2_0041D07C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041E00E 2_2_0041E00E
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041EA8B 2_2_0041EA8B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00402D87 2_2_00402D87
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00409E40 2_2_00409E40
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00409E3C 2_2_00409E3C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE20A0 2_2_00AE20A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B820A8 2_2_00B820A8
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACB090 2_2_00ACB090
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71002 2_2_00B71002
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD4120 2_2_00AD4120
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABF900 2_2_00ABF900
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B822AE 2_2_00B822AE
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEEBB0 2_2_00AEEBB0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7DBD2 2_2_00B7DBD2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B82B28 2_2_00B82B28
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC841F 2_2_00AC841F
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2581 2_2_00AE2581
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACD5E0 2_2_00ACD5E0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B825DD 2_2_00B825DD
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB0D20 2_2_00AB0D20
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B82D07 2_2_00B82D07
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B81D55 2_2_00B81D55
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B82EF7 2_2_00B82EF7
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD6E30 2_2_00AD6E30
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B81FF1 2_2_00B81FF1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048120A0 7_2_048120A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B20A8 7_2_048B20A8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F841F 7_2_047F841F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1002 7_2_048A1002
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FB090 7_2_047FB090
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812581 7_2_04812581
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E0D20 7_2_047E0D20
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EF900 7_2_047EF900
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B2D07 7_2_048B2D07
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FD5E0 7_2_047FD5E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04804120 7_2_04804120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B1D55 7_2_048B1D55
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B22AE 7_2_048B22AE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B2EF7 7_2_048B2EF7
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04806E30 7_2_04806E30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481EBB0 7_2_0481EBB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B1FF1 7_2_048B1FF1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B2B28 7_2_048B2B28
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048D07C 7_2_0048D07C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048E00E 7_2_0048E00E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00472D87 7_2_00472D87
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00472D90 7_2_00472D90
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00479E40 7_2_00479E40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00479E3C 7_2_00479E3C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00472FB0 7_2_00472FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\mstsc.exe Code function: String function: 047EB150 appears 35 times
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: String function: 00ABB150 appears 35 times
Sample file is different than original file name gathered from version info
Source: 202139769574 Shipping Documents.exe, 00000001.00000003.646094416.000000000334F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 202139769574 Shipping Documents.exe
Source: 202139769574 Shipping Documents.exe, 00000002.00000002.701116428.0000000000BAF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 202139769574 Shipping Documents.exe
Source: 202139769574 Shipping Documents.exe, 00000002.00000002.702183379.0000000002823000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamemstsc.exej% vs 202139769574 Shipping Documents.exe
Uses 32bit PE files
Source: 202139769574 Shipping Documents.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.657714825.0000000003070000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.657714825.0000000003070000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.698729438.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.698729438.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.700421859.00000000009D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.700421859.00000000009D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.907951301.0000000000C80000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.907951301.0000000000C80000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.907352431.0000000000470000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.907352431.0000000000470000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000001.650273193.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000001.650273193.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000002.907896289.0000000000A20000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000002.907896289.0000000000A20000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/4@3/2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403461
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_0040473E GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 1_2_0040473E
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_0040216B CoCreateInstance,MultiByteToWideChar, 1_2_0040216B
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:3984:120:WilError_01
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe File created: C:\Users\user\AppData\Local\Temp\nseCE56.tmp Jump to behavior
Source: 202139769574 Shipping Documents.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: 202139769574 Shipping Documents.exe Virustotal: Detection: 33%
Source: 202139769574 Shipping Documents.exe ReversingLabs: Detection: 31%
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe File read: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\202139769574 Shipping Documents.exe 'C:\Users\user\Desktop\202139769574 Shipping Documents.exe'
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Process created: C:\Users\user\Desktop\202139769574 Shipping Documents.exe 'C:\Users\user\Desktop\202139769574 Shipping Documents.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\mstsc.exe C:\Windows\SysWOW64\mstsc.exe
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\202139769574 Shipping Documents.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Process created: C:\Users\user\Desktop\202139769574 Shipping Documents.exe 'C:\Users\user\Desktop\202139769574 Shipping Documents.exe' Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\202139769574 Shipping Documents.exe' Jump to behavior
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: 202139769574 Shipping Documents.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000004.00000000.671162738.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: 202139769574 Shipping Documents.exe, 00000001.00000003.646868549.0000000003230000.00000004.00000001.sdmp, 202139769574 Shipping Documents.exe, 00000002.00000002.700767024.0000000000A90000.00000040.00000001.sdmp, mstsc.exe, 00000007.00000002.909918766.00000000047C0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 202139769574 Shipping Documents.exe, mstsc.exe
Source: Binary string: mstsc.pdbGCTL source: 202139769574 Shipping Documents.exe, 00000002.00000002.701928540.0000000002700000.00000040.00000001.sdmp
Source: Binary string: mstsc.pdb source: 202139769574 Shipping Documents.exe, 00000002.00000002.701928540.0000000002700000.00000040.00000001.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000004.00000000.671162738.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Unpacked PE file: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00416950 push eax; retf 2_2_00416951
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041C167 push ebp; iretd 2_2_0041C16A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00417237 push es; retf 2_2_00417238
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00416BCC push cs; retf 2_2_00416BD4
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0040E394 push ebp; ret 2_2_0040E395
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00416486 push ecx; retf 2_2_0041648C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041DD91 push edi; ret 2_2_0041DD93
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041DE8C push FFFFFF81h; ret 2_2_0041DE8F
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041CEB5 push eax; ret 2_2_0041CF08
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041CF6C push eax; ret 2_2_0041CF72
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041CF02 push eax; ret 2_2_0041CF08
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0041CF0B push eax; ret 2_2_0041CF72
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_004077BF pushfd ; retf 2_2_004077C0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B0D0D1 push ecx; ret 2_2_00B0D0E4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0483D0D1 push ecx; ret 7_2_0483D0E4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00486950 push eax; retf 7_2_00486951
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048C167 push ebp; iretd 7_2_0048C16A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00487237 push es; retf 7_2_00487238
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00486BCC push cs; retf 7_2_00486BD4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0047E394 push ebp; ret 7_2_0047E395
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_00486486 push ecx; retf 7_2_0048648C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048DD91 push edi; ret 7_2_0048DD93
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048DE8C push FFFFFF81h; ret 7_2_0048DE8F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048CEB5 push eax; ret 7_2_0048CF08
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048CF6C push eax; ret 7_2_0048CF72
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048CF0B push eax; ret 7_2_0048CF72
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0048CF02 push eax; ret 7_2_0048CF08
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_004777BF pushfd ; retf 7_2_004777C0

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe File created: C:\Users\user\AppData\Local\Temp\nszCE87.tmp\22m80anrrsp.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8A 0xAE 0xEE
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 00000000004798E4 second address: 00000000004798EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\mstsc.exe RDTSC instruction interceptor: First address: 0000000000479B5E second address: 0000000000479B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00409A90 rdtsc 2_2_00409A90
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 6160 Thread sleep count: 34 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 6160 Thread sleep time: -68000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe TID: 744 Thread sleep time: -60000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_004059F0 CloseHandle,GetTempPathA,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,FindNextFileA,FindClose, 1_2_004059F0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_0040659C FindFirstFileA,FindClose, 1_2_0040659C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_004027A1 FindFirstFileA, 1_2_004027A1
Source: explorer.exe, 00000004.00000000.669826337.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000004.00000000.680935628.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.672497965.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000000.680935628.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000004.00000002.917276050.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000004.00000000.681240089.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000004.00000000.669826337.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000004.00000000.669826337.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000004.00000000.681489254.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000004.00000000.669826337.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00409A90 rdtsc 2_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_0040ACD0 LdrLoadDll, 2_2_0040ACD0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_10001000 mov eax, dword ptr fs:[00000030h] 1_2_10001000
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF90AF mov eax, dword ptr fs:[00000030h] 2_2_00AF90AF
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE20A0 mov eax, dword ptr fs:[00000030h] 2_2_00AE20A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE20A0 mov eax, dword ptr fs:[00000030h] 2_2_00AE20A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE20A0 mov eax, dword ptr fs:[00000030h] 2_2_00AE20A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE20A0 mov eax, dword ptr fs:[00000030h] 2_2_00AE20A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE20A0 mov eax, dword ptr fs:[00000030h] 2_2_00AE20A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE20A0 mov eax, dword ptr fs:[00000030h] 2_2_00AE20A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEF0BF mov ecx, dword ptr fs:[00000030h] 2_2_00AEF0BF
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEF0BF mov eax, dword ptr fs:[00000030h] 2_2_00AEF0BF
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEF0BF mov eax, dword ptr fs:[00000030h] 2_2_00AEF0BF
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB9080 mov eax, dword ptr fs:[00000030h] 2_2_00AB9080
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B33884 mov eax, dword ptr fs:[00000030h] 2_2_00B33884
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B33884 mov eax, dword ptr fs:[00000030h] 2_2_00B33884
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB58EC mov eax, dword ptr fs:[00000030h] 2_2_00AB58EC
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B4B8D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4B8D0 mov ecx, dword ptr fs:[00000030h] 2_2_00B4B8D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B4B8D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B4B8D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B4B8D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B4B8D0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE002D mov eax, dword ptr fs:[00000030h] 2_2_00AE002D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE002D mov eax, dword ptr fs:[00000030h] 2_2_00AE002D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE002D mov eax, dword ptr fs:[00000030h] 2_2_00AE002D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE002D mov eax, dword ptr fs:[00000030h] 2_2_00AE002D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE002D mov eax, dword ptr fs:[00000030h] 2_2_00AE002D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACB02A mov eax, dword ptr fs:[00000030h] 2_2_00ACB02A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACB02A mov eax, dword ptr fs:[00000030h] 2_2_00ACB02A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACB02A mov eax, dword ptr fs:[00000030h] 2_2_00ACB02A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACB02A mov eax, dword ptr fs:[00000030h] 2_2_00ACB02A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B37016 mov eax, dword ptr fs:[00000030h] 2_2_00B37016
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B37016 mov eax, dword ptr fs:[00000030h] 2_2_00B37016
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B37016 mov eax, dword ptr fs:[00000030h] 2_2_00B37016
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B84015 mov eax, dword ptr fs:[00000030h] 2_2_00B84015
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B84015 mov eax, dword ptr fs:[00000030h] 2_2_00B84015
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B72073 mov eax, dword ptr fs:[00000030h] 2_2_00B72073
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B81074 mov eax, dword ptr fs:[00000030h] 2_2_00B81074
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD0050 mov eax, dword ptr fs:[00000030h] 2_2_00AD0050
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD0050 mov eax, dword ptr fs:[00000030h] 2_2_00AD0050
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B351BE mov eax, dword ptr fs:[00000030h] 2_2_00B351BE
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B351BE mov eax, dword ptr fs:[00000030h] 2_2_00B351BE
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B351BE mov eax, dword ptr fs:[00000030h] 2_2_00B351BE
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B351BE mov eax, dword ptr fs:[00000030h] 2_2_00B351BE
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE61A0 mov eax, dword ptr fs:[00000030h] 2_2_00AE61A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE61A0 mov eax, dword ptr fs:[00000030h] 2_2_00AE61A0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B369A6 mov eax, dword ptr fs:[00000030h] 2_2_00B369A6
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEA185 mov eax, dword ptr fs:[00000030h] 2_2_00AEA185
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADC182 mov eax, dword ptr fs:[00000030h] 2_2_00ADC182
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2990 mov eax, dword ptr fs:[00000030h] 2_2_00AE2990
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00ABB1E1
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00ABB1E1
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00ABB1E1
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B441E8 mov eax, dword ptr fs:[00000030h] 2_2_00B441E8
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD4120 mov eax, dword ptr fs:[00000030h] 2_2_00AD4120
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD4120 mov eax, dword ptr fs:[00000030h] 2_2_00AD4120
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD4120 mov eax, dword ptr fs:[00000030h] 2_2_00AD4120
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD4120 mov eax, dword ptr fs:[00000030h] 2_2_00AD4120
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD4120 mov ecx, dword ptr fs:[00000030h] 2_2_00AD4120
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE513A mov eax, dword ptr fs:[00000030h] 2_2_00AE513A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE513A mov eax, dword ptr fs:[00000030h] 2_2_00AE513A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB9100 mov eax, dword ptr fs:[00000030h] 2_2_00AB9100
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB9100 mov eax, dword ptr fs:[00000030h] 2_2_00AB9100
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB9100 mov eax, dword ptr fs:[00000030h] 2_2_00AB9100
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABC962 mov eax, dword ptr fs:[00000030h] 2_2_00ABC962
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABB171 mov eax, dword ptr fs:[00000030h] 2_2_00ABB171
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABB171 mov eax, dword ptr fs:[00000030h] 2_2_00ABB171
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADB944 mov eax, dword ptr fs:[00000030h] 2_2_00ADB944
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADB944 mov eax, dword ptr fs:[00000030h] 2_2_00ADB944
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AB52A5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AB52A5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AB52A5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AB52A5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AB52A5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACAAB0 mov eax, dword ptr fs:[00000030h] 2_2_00ACAAB0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACAAB0 mov eax, dword ptr fs:[00000030h] 2_2_00ACAAB0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEFAB0 mov eax, dword ptr fs:[00000030h] 2_2_00AEFAB0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AED294 mov eax, dword ptr fs:[00000030h] 2_2_00AED294
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AED294 mov eax, dword ptr fs:[00000030h] 2_2_00AED294
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2AE4 mov eax, dword ptr fs:[00000030h] 2_2_00AE2AE4
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2ACB mov eax, dword ptr fs:[00000030h] 2_2_00AE2ACB
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF4A2C mov eax, dword ptr fs:[00000030h] 2_2_00AF4A2C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF4A2C mov eax, dword ptr fs:[00000030h] 2_2_00AF4A2C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC8A0A mov eax, dword ptr fs:[00000030h] 2_2_00AC8A0A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD3A1C mov eax, dword ptr fs:[00000030h] 2_2_00AD3A1C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB5210 mov eax, dword ptr fs:[00000030h] 2_2_00AB5210
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB5210 mov ecx, dword ptr fs:[00000030h] 2_2_00AB5210
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB5210 mov eax, dword ptr fs:[00000030h] 2_2_00AB5210
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB5210 mov eax, dword ptr fs:[00000030h] 2_2_00AB5210
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABAA16 mov eax, dword ptr fs:[00000030h] 2_2_00ABAA16
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABAA16 mov eax, dword ptr fs:[00000030h] 2_2_00ABAA16
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF927A mov eax, dword ptr fs:[00000030h] 2_2_00AF927A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B6B260 mov eax, dword ptr fs:[00000030h] 2_2_00B6B260
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B6B260 mov eax, dword ptr fs:[00000030h] 2_2_00B6B260
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B88A62 mov eax, dword ptr fs:[00000030h] 2_2_00B88A62
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7EA55 mov eax, dword ptr fs:[00000030h] 2_2_00B7EA55
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B44257 mov eax, dword ptr fs:[00000030h] 2_2_00B44257
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB9240 mov eax, dword ptr fs:[00000030h] 2_2_00AB9240
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB9240 mov eax, dword ptr fs:[00000030h] 2_2_00AB9240
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB9240 mov eax, dword ptr fs:[00000030h] 2_2_00AB9240
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB9240 mov eax, dword ptr fs:[00000030h] 2_2_00AB9240
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE4BAD mov eax, dword ptr fs:[00000030h] 2_2_00AE4BAD
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE4BAD mov eax, dword ptr fs:[00000030h] 2_2_00AE4BAD
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE4BAD mov eax, dword ptr fs:[00000030h] 2_2_00AE4BAD
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B85BA5 mov eax, dword ptr fs:[00000030h] 2_2_00B85BA5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC1B8F mov eax, dword ptr fs:[00000030h] 2_2_00AC1B8F
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC1B8F mov eax, dword ptr fs:[00000030h] 2_2_00AC1B8F
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B6D380 mov ecx, dword ptr fs:[00000030h] 2_2_00B6D380
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2397 mov eax, dword ptr fs:[00000030h] 2_2_00AE2397
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7138A mov eax, dword ptr fs:[00000030h] 2_2_00B7138A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEB390 mov eax, dword ptr fs:[00000030h] 2_2_00AEB390
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADDBE9 mov eax, dword ptr fs:[00000030h] 2_2_00ADDBE9
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE03E2 mov eax, dword ptr fs:[00000030h] 2_2_00AE03E2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE03E2 mov eax, dword ptr fs:[00000030h] 2_2_00AE03E2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE03E2 mov eax, dword ptr fs:[00000030h] 2_2_00AE03E2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE03E2 mov eax, dword ptr fs:[00000030h] 2_2_00AE03E2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE03E2 mov eax, dword ptr fs:[00000030h] 2_2_00AE03E2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE03E2 mov eax, dword ptr fs:[00000030h] 2_2_00AE03E2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B353CA mov eax, dword ptr fs:[00000030h] 2_2_00B353CA
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B353CA mov eax, dword ptr fs:[00000030h] 2_2_00B353CA
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7131B mov eax, dword ptr fs:[00000030h] 2_2_00B7131B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABDB60 mov ecx, dword ptr fs:[00000030h] 2_2_00ABDB60
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE3B7A mov eax, dword ptr fs:[00000030h] 2_2_00AE3B7A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE3B7A mov eax, dword ptr fs:[00000030h] 2_2_00AE3B7A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B88B58 mov eax, dword ptr fs:[00000030h] 2_2_00B88B58
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABDB40 mov eax, dword ptr fs:[00000030h] 2_2_00ABDB40
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABF358 mov eax, dword ptr fs:[00000030h] 2_2_00ABF358
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC849B mov eax, dword ptr fs:[00000030h] 2_2_00AC849B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36CF0 mov eax, dword ptr fs:[00000030h] 2_2_00B36CF0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36CF0 mov eax, dword ptr fs:[00000030h] 2_2_00B36CF0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36CF0 mov eax, dword ptr fs:[00000030h] 2_2_00B36CF0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B714FB mov eax, dword ptr fs:[00000030h] 2_2_00B714FB
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B88CD6 mov eax, dword ptr fs:[00000030h] 2_2_00B88CD6
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEBC2C mov eax, dword ptr fs:[00000030h] 2_2_00AEBC2C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71C06 mov eax, dword ptr fs:[00000030h] 2_2_00B71C06
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B8740D mov eax, dword ptr fs:[00000030h] 2_2_00B8740D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B8740D mov eax, dword ptr fs:[00000030h] 2_2_00B8740D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B8740D mov eax, dword ptr fs:[00000030h] 2_2_00B8740D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36C0A mov eax, dword ptr fs:[00000030h] 2_2_00B36C0A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36C0A mov eax, dword ptr fs:[00000030h] 2_2_00B36C0A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36C0A mov eax, dword ptr fs:[00000030h] 2_2_00B36C0A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36C0A mov eax, dword ptr fs:[00000030h] 2_2_00B36C0A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD746D mov eax, dword ptr fs:[00000030h] 2_2_00AD746D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4C450 mov eax, dword ptr fs:[00000030h] 2_2_00B4C450
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4C450 mov eax, dword ptr fs:[00000030h] 2_2_00B4C450
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEA44B mov eax, dword ptr fs:[00000030h] 2_2_00AEA44B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE35A1 mov eax, dword ptr fs:[00000030h] 2_2_00AE35A1
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B805AC mov eax, dword ptr fs:[00000030h] 2_2_00B805AC
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B805AC mov eax, dword ptr fs:[00000030h] 2_2_00B805AC
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE1DB5 mov eax, dword ptr fs:[00000030h] 2_2_00AE1DB5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE1DB5 mov eax, dword ptr fs:[00000030h] 2_2_00AE1DB5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE1DB5 mov eax, dword ptr fs:[00000030h] 2_2_00AE1DB5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AB2D8A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AB2D8A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AB2D8A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AB2D8A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AB2D8A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2581 mov eax, dword ptr fs:[00000030h] 2_2_00AE2581
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2581 mov eax, dword ptr fs:[00000030h] 2_2_00AE2581
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2581 mov eax, dword ptr fs:[00000030h] 2_2_00AE2581
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE2581 mov eax, dword ptr fs:[00000030h] 2_2_00AE2581
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEFD9B mov eax, dword ptr fs:[00000030h] 2_2_00AEFD9B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEFD9B mov eax, dword ptr fs:[00000030h] 2_2_00AEFD9B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B68DF1 mov eax, dword ptr fs:[00000030h] 2_2_00B68DF1
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACD5E0 mov eax, dword ptr fs:[00000030h] 2_2_00ACD5E0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACD5E0 mov eax, dword ptr fs:[00000030h] 2_2_00ACD5E0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00B7FDE2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00B7FDE2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00B7FDE2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00B7FDE2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B36DC9
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B36DC9
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B36DC9
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36DC9 mov ecx, dword ptr fs:[00000030h] 2_2_00B36DC9
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B36DC9
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B36DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B36DC9
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B3A537 mov eax, dword ptr fs:[00000030h] 2_2_00B3A537
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B88D34 mov eax, dword ptr fs:[00000030h] 2_2_00B88D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7E539 mov eax, dword ptr fs:[00000030h] 2_2_00B7E539
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE4D3B mov eax, dword ptr fs:[00000030h] 2_2_00AE4D3B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE4D3B mov eax, dword ptr fs:[00000030h] 2_2_00AE4D3B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE4D3B mov eax, dword ptr fs:[00000030h] 2_2_00AE4D3B
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AC3D34
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABAD30 mov eax, dword ptr fs:[00000030h] 2_2_00ABAD30
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADC577 mov eax, dword ptr fs:[00000030h] 2_2_00ADC577
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADC577 mov eax, dword ptr fs:[00000030h] 2_2_00ADC577
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF3D43 mov eax, dword ptr fs:[00000030h] 2_2_00AF3D43
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B33540 mov eax, dword ptr fs:[00000030h] 2_2_00B33540
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AD7D50 mov eax, dword ptr fs:[00000030h] 2_2_00AD7D50
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B346A7 mov eax, dword ptr fs:[00000030h] 2_2_00B346A7
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B80EA5 mov eax, dword ptr fs:[00000030h] 2_2_00B80EA5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B80EA5 mov eax, dword ptr fs:[00000030h] 2_2_00B80EA5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B80EA5 mov eax, dword ptr fs:[00000030h] 2_2_00B80EA5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4FE87 mov eax, dword ptr fs:[00000030h] 2_2_00B4FE87
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE16E0 mov ecx, dword ptr fs:[00000030h] 2_2_00AE16E0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC76E2 mov eax, dword ptr fs:[00000030h] 2_2_00AC76E2
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE36CC mov eax, dword ptr fs:[00000030h] 2_2_00AE36CC
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF8EC7 mov eax, dword ptr fs:[00000030h] 2_2_00AF8EC7
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B88ED6 mov eax, dword ptr fs:[00000030h] 2_2_00B88ED6
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B6FEC0 mov eax, dword ptr fs:[00000030h] 2_2_00B6FEC0
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B6FE3F mov eax, dword ptr fs:[00000030h] 2_2_00B6FE3F
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABE620 mov eax, dword ptr fs:[00000030h] 2_2_00ABE620
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABC600 mov eax, dword ptr fs:[00000030h] 2_2_00ABC600
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABC600 mov eax, dword ptr fs:[00000030h] 2_2_00ABC600
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ABC600 mov eax, dword ptr fs:[00000030h] 2_2_00ABC600
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AE8E00 mov eax, dword ptr fs:[00000030h] 2_2_00AE8E00
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEA61C mov eax, dword ptr fs:[00000030h] 2_2_00AEA61C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEA61C mov eax, dword ptr fs:[00000030h] 2_2_00AEA61C
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B71608 mov eax, dword ptr fs:[00000030h] 2_2_00B71608
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC766D mov eax, dword ptr fs:[00000030h] 2_2_00AC766D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADAE73 mov eax, dword ptr fs:[00000030h] 2_2_00ADAE73
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADAE73 mov eax, dword ptr fs:[00000030h] 2_2_00ADAE73
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADAE73 mov eax, dword ptr fs:[00000030h] 2_2_00ADAE73
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADAE73 mov eax, dword ptr fs:[00000030h] 2_2_00ADAE73
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADAE73 mov eax, dword ptr fs:[00000030h] 2_2_00ADAE73
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AC7E41
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AC7E41
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AC7E41
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AC7E41
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AC7E41
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AC7E41
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7AE44 mov eax, dword ptr fs:[00000030h] 2_2_00B7AE44
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B7AE44 mov eax, dword ptr fs:[00000030h] 2_2_00B7AE44
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B37794 mov eax, dword ptr fs:[00000030h] 2_2_00B37794
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B37794 mov eax, dword ptr fs:[00000030h] 2_2_00B37794
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B37794 mov eax, dword ptr fs:[00000030h] 2_2_00B37794
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AC8794 mov eax, dword ptr fs:[00000030h] 2_2_00AC8794
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AF37F5 mov eax, dword ptr fs:[00000030h] 2_2_00AF37F5
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB4F2E mov eax, dword ptr fs:[00000030h] 2_2_00AB4F2E
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AB4F2E mov eax, dword ptr fs:[00000030h] 2_2_00AB4F2E
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEE730 mov eax, dword ptr fs:[00000030h] 2_2_00AEE730
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEA70E mov eax, dword ptr fs:[00000030h] 2_2_00AEA70E
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00AEA70E mov eax, dword ptr fs:[00000030h] 2_2_00AEA70E
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4FF10 mov eax, dword ptr fs:[00000030h] 2_2_00B4FF10
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B4FF10 mov eax, dword ptr fs:[00000030h] 2_2_00B4FF10
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B8070D mov eax, dword ptr fs:[00000030h] 2_2_00B8070D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B8070D mov eax, dword ptr fs:[00000030h] 2_2_00B8070D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ADF716 mov eax, dword ptr fs:[00000030h] 2_2_00ADF716
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACFF60 mov eax, dword ptr fs:[00000030h] 2_2_00ACFF60
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00B88F6A mov eax, dword ptr fs:[00000030h] 2_2_00B88F6A
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 2_2_00ACEF40 mov eax, dword ptr fs:[00000030h] 2_2_00ACEF40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04863884 mov eax, dword ptr fs:[00000030h] 7_2_04863884
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04863884 mov eax, dword ptr fs:[00000030h] 7_2_04863884
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048120A0 mov eax, dword ptr fs:[00000030h] 7_2_048120A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048120A0 mov eax, dword ptr fs:[00000030h] 7_2_048120A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048120A0 mov eax, dword ptr fs:[00000030h] 7_2_048120A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048120A0 mov eax, dword ptr fs:[00000030h] 7_2_048120A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048120A0 mov eax, dword ptr fs:[00000030h] 7_2_048120A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048120A0 mov eax, dword ptr fs:[00000030h] 7_2_048120A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048290AF mov eax, dword ptr fs:[00000030h] 7_2_048290AF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481F0BF mov ecx, dword ptr fs:[00000030h] 7_2_0481F0BF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481F0BF mov eax, dword ptr fs:[00000030h] 7_2_0481F0BF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481F0BF mov eax, dword ptr fs:[00000030h] 7_2_0481F0BF
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FB02A mov eax, dword ptr fs:[00000030h] 7_2_047FB02A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FB02A mov eax, dword ptr fs:[00000030h] 7_2_047FB02A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FB02A mov eax, dword ptr fs:[00000030h] 7_2_047FB02A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FB02A mov eax, dword ptr fs:[00000030h] 7_2_047FB02A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0487B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487B8D0 mov ecx, dword ptr fs:[00000030h] 7_2_0487B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0487B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0487B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0487B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487B8D0 mov eax, dword ptr fs:[00000030h] 7_2_0487B8D0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B8CD6 mov eax, dword ptr fs:[00000030h] 7_2_048B8CD6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A14FB mov eax, dword ptr fs:[00000030h] 7_2_048A14FB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866CF0 mov eax, dword ptr fs:[00000030h] 7_2_04866CF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866CF0 mov eax, dword ptr fs:[00000030h] 7_2_04866CF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866CF0 mov eax, dword ptr fs:[00000030h] 7_2_04866CF0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B740D mov eax, dword ptr fs:[00000030h] 7_2_048B740D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B740D mov eax, dword ptr fs:[00000030h] 7_2_048B740D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B740D mov eax, dword ptr fs:[00000030h] 7_2_048B740D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1C06 mov eax, dword ptr fs:[00000030h] 7_2_048A1C06
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866C0A mov eax, dword ptr fs:[00000030h] 7_2_04866C0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866C0A mov eax, dword ptr fs:[00000030h] 7_2_04866C0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866C0A mov eax, dword ptr fs:[00000030h] 7_2_04866C0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866C0A mov eax, dword ptr fs:[00000030h] 7_2_04866C0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04867016 mov eax, dword ptr fs:[00000030h] 7_2_04867016
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04867016 mov eax, dword ptr fs:[00000030h] 7_2_04867016
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04867016 mov eax, dword ptr fs:[00000030h] 7_2_04867016
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E58EC mov eax, dword ptr fs:[00000030h] 7_2_047E58EC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B4015 mov eax, dword ptr fs:[00000030h] 7_2_048B4015
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B4015 mov eax, dword ptr fs:[00000030h] 7_2_048B4015
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481002D mov eax, dword ptr fs:[00000030h] 7_2_0481002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481002D mov eax, dword ptr fs:[00000030h] 7_2_0481002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481002D mov eax, dword ptr fs:[00000030h] 7_2_0481002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481002D mov eax, dword ptr fs:[00000030h] 7_2_0481002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481002D mov eax, dword ptr fs:[00000030h] 7_2_0481002D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481BC2C mov eax, dword ptr fs:[00000030h] 7_2_0481BC2C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481A44B mov eax, dword ptr fs:[00000030h] 7_2_0481A44B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04800050 mov eax, dword ptr fs:[00000030h] 7_2_04800050
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04800050 mov eax, dword ptr fs:[00000030h] 7_2_04800050
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487C450 mov eax, dword ptr fs:[00000030h] 7_2_0487C450
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487C450 mov eax, dword ptr fs:[00000030h] 7_2_0487C450
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F849B mov eax, dword ptr fs:[00000030h] 7_2_047F849B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480746D mov eax, dword ptr fs:[00000030h] 7_2_0480746D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A2073 mov eax, dword ptr fs:[00000030h] 7_2_048A2073
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E9080 mov eax, dword ptr fs:[00000030h] 7_2_047E9080
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B1074 mov eax, dword ptr fs:[00000030h] 7_2_048B1074
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812581 mov eax, dword ptr fs:[00000030h] 7_2_04812581
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812581 mov eax, dword ptr fs:[00000030h] 7_2_04812581
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812581 mov eax, dword ptr fs:[00000030h] 7_2_04812581
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812581 mov eax, dword ptr fs:[00000030h] 7_2_04812581
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480C182 mov eax, dword ptr fs:[00000030h] 7_2_0480C182
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481A185 mov eax, dword ptr fs:[00000030h] 7_2_0481A185
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EB171 mov eax, dword ptr fs:[00000030h] 7_2_047EB171
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EB171 mov eax, dword ptr fs:[00000030h] 7_2_047EB171
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812990 mov eax, dword ptr fs:[00000030h] 7_2_04812990
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481FD9B mov eax, dword ptr fs:[00000030h] 7_2_0481FD9B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481FD9B mov eax, dword ptr fs:[00000030h] 7_2_0481FD9B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EC962 mov eax, dword ptr fs:[00000030h] 7_2_047EC962
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048135A1 mov eax, dword ptr fs:[00000030h] 7_2_048135A1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048669A6 mov eax, dword ptr fs:[00000030h] 7_2_048669A6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048161A0 mov eax, dword ptr fs:[00000030h] 7_2_048161A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048161A0 mov eax, dword ptr fs:[00000030h] 7_2_048161A0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B05AC mov eax, dword ptr fs:[00000030h] 7_2_048B05AC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B05AC mov eax, dword ptr fs:[00000030h] 7_2_048B05AC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04811DB5 mov eax, dword ptr fs:[00000030h] 7_2_04811DB5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04811DB5 mov eax, dword ptr fs:[00000030h] 7_2_04811DB5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04811DB5 mov eax, dword ptr fs:[00000030h] 7_2_04811DB5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048651BE mov eax, dword ptr fs:[00000030h] 7_2_048651BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048651BE mov eax, dword ptr fs:[00000030h] 7_2_048651BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048651BE mov eax, dword ptr fs:[00000030h] 7_2_048651BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048651BE mov eax, dword ptr fs:[00000030h] 7_2_048651BE
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F3D34 mov eax, dword ptr fs:[00000030h] 7_2_047F3D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EAD30 mov eax, dword ptr fs:[00000030h] 7_2_047EAD30
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866DC9 mov eax, dword ptr fs:[00000030h] 7_2_04866DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866DC9 mov eax, dword ptr fs:[00000030h] 7_2_04866DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866DC9 mov eax, dword ptr fs:[00000030h] 7_2_04866DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866DC9 mov ecx, dword ptr fs:[00000030h] 7_2_04866DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866DC9 mov eax, dword ptr fs:[00000030h] 7_2_04866DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04866DC9 mov eax, dword ptr fs:[00000030h] 7_2_04866DC9
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048741E8 mov eax, dword ptr fs:[00000030h] 7_2_048741E8
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04898DF1 mov eax, dword ptr fs:[00000030h] 7_2_04898DF1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E9100 mov eax, dword ptr fs:[00000030h] 7_2_047E9100
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E9100 mov eax, dword ptr fs:[00000030h] 7_2_047E9100
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E9100 mov eax, dword ptr fs:[00000030h] 7_2_047E9100
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EB1E1 mov eax, dword ptr fs:[00000030h] 7_2_047EB1E1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EB1E1 mov eax, dword ptr fs:[00000030h] 7_2_047EB1E1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EB1E1 mov eax, dword ptr fs:[00000030h] 7_2_047EB1E1
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FD5E0 mov eax, dword ptr fs:[00000030h] 7_2_047FD5E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FD5E0 mov eax, dword ptr fs:[00000030h] 7_2_047FD5E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04804120 mov eax, dword ptr fs:[00000030h] 7_2_04804120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04804120 mov eax, dword ptr fs:[00000030h] 7_2_04804120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04804120 mov eax, dword ptr fs:[00000030h] 7_2_04804120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04804120 mov eax, dword ptr fs:[00000030h] 7_2_04804120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04804120 mov ecx, dword ptr fs:[00000030h] 7_2_04804120
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0486A537 mov eax, dword ptr fs:[00000030h] 7_2_0486A537
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04814D3B mov eax, dword ptr fs:[00000030h] 7_2_04814D3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04814D3B mov eax, dword ptr fs:[00000030h] 7_2_04814D3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04814D3B mov eax, dword ptr fs:[00000030h] 7_2_04814D3B
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481513A mov eax, dword ptr fs:[00000030h] 7_2_0481513A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481513A mov eax, dword ptr fs:[00000030h] 7_2_0481513A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B8D34 mov eax, dword ptr fs:[00000030h] 7_2_048B8D34
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04823D43 mov eax, dword ptr fs:[00000030h] 7_2_04823D43
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480B944 mov eax, dword ptr fs:[00000030h] 7_2_0480B944
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480B944 mov eax, dword ptr fs:[00000030h] 7_2_0480B944
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04863540 mov eax, dword ptr fs:[00000030h] 7_2_04863540
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04807D50 mov eax, dword ptr fs:[00000030h] 7_2_04807D50
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E2D8A mov eax, dword ptr fs:[00000030h] 7_2_047E2D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E2D8A mov eax, dword ptr fs:[00000030h] 7_2_047E2D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E2D8A mov eax, dword ptr fs:[00000030h] 7_2_047E2D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E2D8A mov eax, dword ptr fs:[00000030h] 7_2_047E2D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E2D8A mov eax, dword ptr fs:[00000030h] 7_2_047E2D8A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480C577 mov eax, dword ptr fs:[00000030h] 7_2_0480C577
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480C577 mov eax, dword ptr fs:[00000030h] 7_2_0480C577
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0487FE87 mov eax, dword ptr fs:[00000030h] 7_2_0487FE87
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F766D mov eax, dword ptr fs:[00000030h] 7_2_047F766D
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481D294 mov eax, dword ptr fs:[00000030h] 7_2_0481D294
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481D294 mov eax, dword ptr fs:[00000030h] 7_2_0481D294
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048646A7 mov eax, dword ptr fs:[00000030h] 7_2_048646A7
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B0EA5 mov eax, dword ptr fs:[00000030h] 7_2_048B0EA5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B0EA5 mov eax, dword ptr fs:[00000030h] 7_2_048B0EA5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B0EA5 mov eax, dword ptr fs:[00000030h] 7_2_048B0EA5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481FAB0 mov eax, dword ptr fs:[00000030h] 7_2_0481FAB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E9240 mov eax, dword ptr fs:[00000030h] 7_2_047E9240
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E9240 mov eax, dword ptr fs:[00000030h] 7_2_047E9240
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E9240 mov eax, dword ptr fs:[00000030h] 7_2_047E9240
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E9240 mov eax, dword ptr fs:[00000030h] 7_2_047E9240
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F7E41 mov eax, dword ptr fs:[00000030h] 7_2_047F7E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F7E41 mov eax, dword ptr fs:[00000030h] 7_2_047F7E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F7E41 mov eax, dword ptr fs:[00000030h] 7_2_047F7E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F7E41 mov eax, dword ptr fs:[00000030h] 7_2_047F7E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F7E41 mov eax, dword ptr fs:[00000030h] 7_2_047F7E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F7E41 mov eax, dword ptr fs:[00000030h] 7_2_047F7E41
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04828EC7 mov eax, dword ptr fs:[00000030h] 7_2_04828EC7
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0489FEC0 mov eax, dword ptr fs:[00000030h] 7_2_0489FEC0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812ACB mov eax, dword ptr fs:[00000030h] 7_2_04812ACB
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048136CC mov eax, dword ptr fs:[00000030h] 7_2_048136CC
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B8ED6 mov eax, dword ptr fs:[00000030h] 7_2_048B8ED6
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EE620 mov eax, dword ptr fs:[00000030h] 7_2_047EE620
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048116E0 mov ecx, dword ptr fs:[00000030h] 7_2_048116E0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812AE4 mov eax, dword ptr fs:[00000030h] 7_2_04812AE4
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EAA16 mov eax, dword ptr fs:[00000030h] 7_2_047EAA16
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EAA16 mov eax, dword ptr fs:[00000030h] 7_2_047EAA16
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E5210 mov eax, dword ptr fs:[00000030h] 7_2_047E5210
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E5210 mov ecx, dword ptr fs:[00000030h] 7_2_047E5210
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E5210 mov eax, dword ptr fs:[00000030h] 7_2_047E5210
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E5210 mov eax, dword ptr fs:[00000030h] 7_2_047E5210
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F8A0A mov eax, dword ptr fs:[00000030h] 7_2_047F8A0A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EC600 mov eax, dword ptr fs:[00000030h] 7_2_047EC600
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EC600 mov eax, dword ptr fs:[00000030h] 7_2_047EC600
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EC600 mov eax, dword ptr fs:[00000030h] 7_2_047EC600
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04818E00 mov eax, dword ptr fs:[00000030h] 7_2_04818E00
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A1608 mov eax, dword ptr fs:[00000030h] 7_2_048A1608
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04803A1C mov eax, dword ptr fs:[00000030h] 7_2_04803A1C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047F76E2 mov eax, dword ptr fs:[00000030h] 7_2_047F76E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481A61C mov eax, dword ptr fs:[00000030h] 7_2_0481A61C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481A61C mov eax, dword ptr fs:[00000030h] 7_2_0481A61C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04824A2C mov eax, dword ptr fs:[00000030h] 7_2_04824A2C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04824A2C mov eax, dword ptr fs:[00000030h] 7_2_04824A2C
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0489FE3F mov eax, dword ptr fs:[00000030h] 7_2_0489FE3F
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FAAB0 mov eax, dword ptr fs:[00000030h] 7_2_047FAAB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FAAB0 mov eax, dword ptr fs:[00000030h] 7_2_047FAAB0
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04874257 mov eax, dword ptr fs:[00000030h] 7_2_04874257
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E52A5 mov eax, dword ptr fs:[00000030h] 7_2_047E52A5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E52A5 mov eax, dword ptr fs:[00000030h] 7_2_047E52A5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E52A5 mov eax, dword ptr fs:[00000030h] 7_2_047E52A5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E52A5 mov eax, dword ptr fs:[00000030h] 7_2_047E52A5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E52A5 mov eax, dword ptr fs:[00000030h] 7_2_047E52A5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0489B260 mov eax, dword ptr fs:[00000030h] 7_2_0489B260
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0489B260 mov eax, dword ptr fs:[00000030h] 7_2_0489B260
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B8A62 mov eax, dword ptr fs:[00000030h] 7_2_048B8A62
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480AE73 mov eax, dword ptr fs:[00000030h] 7_2_0480AE73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480AE73 mov eax, dword ptr fs:[00000030h] 7_2_0480AE73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480AE73 mov eax, dword ptr fs:[00000030h] 7_2_0480AE73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480AE73 mov eax, dword ptr fs:[00000030h] 7_2_0480AE73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0480AE73 mov eax, dword ptr fs:[00000030h] 7_2_0480AE73
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0482927A mov eax, dword ptr fs:[00000030h] 7_2_0482927A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048A138A mov eax, dword ptr fs:[00000030h] 7_2_048A138A
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0489D380 mov ecx, dword ptr fs:[00000030h] 7_2_0489D380
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_0481B390 mov eax, dword ptr fs:[00000030h] 7_2_0481B390
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04867794 mov eax, dword ptr fs:[00000030h] 7_2_04867794
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04867794 mov eax, dword ptr fs:[00000030h] 7_2_04867794
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04867794 mov eax, dword ptr fs:[00000030h] 7_2_04867794
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04812397 mov eax, dword ptr fs:[00000030h] 7_2_04812397
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EDB60 mov ecx, dword ptr fs:[00000030h] 7_2_047EDB60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FFF60 mov eax, dword ptr fs:[00000030h] 7_2_047FFF60
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EF358 mov eax, dword ptr fs:[00000030h] 7_2_047EF358
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04814BAD mov eax, dword ptr fs:[00000030h] 7_2_04814BAD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04814BAD mov eax, dword ptr fs:[00000030h] 7_2_04814BAD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_04814BAD mov eax, dword ptr fs:[00000030h] 7_2_04814BAD
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048B5BA5 mov eax, dword ptr fs:[00000030h] 7_2_048B5BA5
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047EDB40 mov eax, dword ptr fs:[00000030h] 7_2_047EDB40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047FEF40 mov eax, dword ptr fs:[00000030h] 7_2_047FEF40
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048653CA mov eax, dword ptr fs:[00000030h] 7_2_048653CA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048653CA mov eax, dword ptr fs:[00000030h] 7_2_048653CA
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E4F2E mov eax, dword ptr fs:[00000030h] 7_2_047E4F2E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_047E4F2E mov eax, dword ptr fs:[00000030h] 7_2_047E4F2E
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048103E2 mov eax, dword ptr fs:[00000030h] 7_2_048103E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048103E2 mov eax, dword ptr fs:[00000030h] 7_2_048103E2
Source: C:\Windows\SysWOW64\mstsc.exe Code function: 7_2_048103E2 mov eax, dword ptr fs:[00000030h] 7_2_048103E2
Enables debug privileges
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_10001548 SetUnhandledExceptionFilter,UnhandledExceptionFilter,GetCurrentProcess,TerminateProcess, 1_2_10001548

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.maluss.com
Source: C:\Windows\explorer.exe Domain query: www.magnumopuspro.com
Source: C:\Windows\explorer.exe Domain query: www.exclusiveflooringcollection.com
Source: C:\Windows\explorer.exe Network Connect: 23.227.38.74 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 198.185.159.144 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Section loaded: unknown target: C:\Users\user\Desktop\202139769574 Shipping Documents.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Section loaded: unknown target: C:\Windows\SysWOW64\mstsc.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Section unmapped: C:\Windows\SysWOW64\mstsc.exe base address: D20000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Process created: C:\Users\user\Desktop\202139769574 Shipping Documents.exe 'C:\Users\user\Desktop\202139769574 Shipping Documents.exe' Jump to behavior
Source: C:\Windows\SysWOW64\mstsc.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\202139769574 Shipping Documents.exe' Jump to behavior
Source: explorer.exe, 00000004.00000000.654816016.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000004.00000000.655818180.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000007.00000002.909210651.0000000003070000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000000.672439987.0000000005E50000.00000004.00000001.sdmp, mstsc.exe, 00000007.00000002.909210651.0000000003070000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.655818180.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000007.00000002.909210651.0000000003070000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000004.00000000.655818180.0000000001080000.00000002.00000001.sdmp, mstsc.exe, 00000007.00000002.909210651.0000000003070000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000004.00000000.681240089.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D
Source: C:\Users\user\Desktop\202139769574 Shipping Documents.exe Code function: 1_2_00403461 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoA,GetCommandLineA,CharNextA,GetTempPathA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,GetTempPathA,lstrcatA,SetEnvironmentVariableA,SetEnvironmentVariableA,SetEnvironmentVariableA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcatA,lstrcatA,lstrcmpiA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueA,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 1_2_00403461

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.657714825.0000000003070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.698729438.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.700421859.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907951301.0000000000C80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907352431.0000000000470000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.650273193.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907896289.0000000000A20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.1.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.202139769574 Shipping Documents.exe.3070000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.699986623.0000000000620000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.657714825.0000000003070000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.698729438.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.700421859.00000000009D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907951301.0000000000C80000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907352431.0000000000470000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.650273193.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000002.907896289.0000000000A20000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.1.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.202139769574 Shipping Documents.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.202139769574 Shipping Documents.exe.3070000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.202139769574 Shipping Documents.exe.3070000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.202139769574 Shipping Documents.exe.400000.0.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 403523 Sample: 202139769574 Shipping Docum... Startdate: 04/05/2021 Architecture: WINDOWS Score: 100 36 Found malware configuration 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 8 other signatures 2->42 10 202139769574 Shipping Documents.exe 19 2->10         started        process3 file4 28 C:\Users\user\AppData\...\22m80anrrsp.dll, PE32 10->28 dropped 52 Maps a DLL or memory area into another process 10->52 14 202139769574 Shipping Documents.exe 10->14         started        signatures5 process6 signatures7 54 Modifies the context of a thread in another process (thread injection) 14->54 56 Maps a DLL or memory area into another process 14->56 58 Sample uses process hollowing technique 14->58 60 Queues an APC in another process (thread injection) 14->60 17 explorer.exe 14->17 injected process8 dnsIp9 30 shops.myshopify.com 23.227.38.74, 49754, 80 CLOUDFLARENETUS Canada 17->30 32 www.maluss.com 17->32 34 4 other IPs or domains 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 mstsc.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
198.185.159.144
 ext-sq.squarespace.com United States
53831 SQUARESPACEUS false
23.227.38.74
 shops.myshopify.com Canada
13335 CLOUDFLARENETUS true

Contacted Domains

Name IP Active
shops.myshopify.com 23.227.38.74 true
ext-sq.squarespace.com 198.185.159.144 true
www.maluss.com unknown unknown
www.magnumopuspro.com unknown unknown
www.exclusiveflooringcollection.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.exclusiveflooringcollection.com/nyr/?tVZl=EDKKYtZbbvwE4Q/e7xe/ld4gtfmRUWoVn+FtgOYbXYxqqFBCU6VSMnG1GKc/0KEvkVST&U4kp=NtxHhLZ8S6kT5jw true
  • Avira URL Cloud: safe
 unknown
http://www.maluss.com/nyr/?tVZl=MKniHD/KKNZ944A0QkseLq559MRPs5jQaAqVav9SZ3PAwf03LQBPNZ+ImXhjCplVxvzR&U4kp=NtxHhLZ8S6kT5jw true
  • Avira URL Cloud: safe
 unknown
www.magnumopuspro.com/nyr/ true
  • Avira URL Cloud: safe
 low