Analysis Report SX365783909782021.bat

Overview

General Information

Sample Name: SX365783909782021.bat (renamed file extension from bat to exe)
Analysis ID: 433214
MD5: ee1f4a07b874aa6ba18d6aa0f83252d3
SHA1: d17b97dc47707b685bc8976d3cbc6cdbfbd5fcee
SHA256: d66268222a39fd97e792983a3bacdb1e81067b7a28848a87fe65a5dc91f7e82a
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Detected unpacking (changes PE section rights)
Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
System process connects to network (likely due to code injection or exploit)
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Drops PE files
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.moneyhuntercom.info/ngvm/"], "decoy": ["justiceforashleymoore.com", "tyqbfe.com", "zydonghua.com", "crossfootwear.com", "mysticlight-shop.com", "digitaldefenseacademy.com", "joyfulgoodies.com", "blog-kotori-haru.com", "atelierlinneakunstoghelse.com", "destinyonlineacademy.com", "series.onl", "bellizzo.com", "totalscalpsolutions.com", "musicrowstudiorecording.com", "digitalgamerentals.com", "princecreativehk.com", "bitchesofzion.com", "imodalmarine.com", "chilly-sauce.com", "studionikolla.com", "jilluonlinemart.com", "ypoinc.com", "chothuenhaxuongtphcm.com", "gadamagado.com", "cartscroll.com", "congying1688.com", "fesdimac.com", "xn--rhqu70hdoa298e.com", "zkdxin168.com", "the-plague-doctor.com", "speakeroo.online", "urban-xr.com", "kanjani8-house.com", "alberaber.com", "eamm-eg.com", "alsawtisrael.com", "deathvalleysolar.com", "vuyo.club", "zcoatux.icu", "marksfly.com", "advertisershopper.com", "hashratelab.com", "broadesys.com", "sampoelstra.com", "poacolors.com", "sciencelogicandfaith.com", "bootupcertificatemount.xyz", "alotranscend.com", "steadwaybytriarc.com", "simplefinest.com", "adinaroseyoga.com", "btb659.com", "ecftech.com", "caravansforsalenorthwales.com", "e1536.com", "sellmyhouseolympia.com", "vacalinda.com", "truegemsproperty.com", "aeternusprofero.com", "djspencer.com", "zhubviz.online", "xn--r2bnc0b.com", "luisxe.info", "servicesbackyard.com"]}
Multi AV Scanner detection for submitted file
Source: SX365783909782021.exe Virustotal: Detection: 31% Perma Link
Source: SX365783909782021.exe ReversingLabs: Detection: 39%
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.473754310.0000000003200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.209804420.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.258786803.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.211210535.00000000022B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.258837957.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.472090660.0000000000C30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.2.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SX365783909782021.exe.22b0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SX365783909782021.exe.22b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: SX365783909782021.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 2.2.SX365783909782021.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.help.exe.3b2f834.5.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 2.1.SX365783909782021.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 5.2.help.exe.d3d870.2.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 0.2.SX365783909782021.exe.22b0000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: SX365783909782021.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: wntdll.pdbUGP source: SX365783909782021.exe, 00000000.00000003.209611066.0000000009B30000.00000004.00000001.sdmp, SX365783909782021.exe, 00000002.00000002.258947287.0000000000BA0000.00000040.00000001.sdmp, help.exe, 00000005.00000002.474720424.000000000371F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SX365783909782021.exe, help.exe
Source: Binary string: help.pdbGCTL source: SX365783909782021.exe, 00000002.00000002.258899247.0000000000769000.00000004.00000020.sdmp
Source: Binary string: help.pdb source: SX365783909782021.exe, 00000002.00000002.258899247.0000000000769000.00000004.00000020.sdmp
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00405E61 FindFirstFileA,FindClose, 0_2_00405E61
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_0040548B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_0040263E FindFirstFileA, 0_2_0040263E

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 4x nop then pop edi 2_2_00416CB5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 4x nop then pop edi 2_1_00416CB5
Source: C:\Windows\SysWOW64\help.exe Code function: 4x nop then pop edi 5_2_03216CB5

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49740 -> 168.235.88.209:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49740 -> 168.235.88.209:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49740 -> 168.235.88.209:80
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.moneyhuntercom.info/ngvm/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /ngvm/?w6A=st23zvU/E1xU5Qy7Hp2PD30UnMfCa5knANSLf3ItiB6oVvQd6+qg6yvUWRtcyiXbPLds&3fox=SBZ4 HTTP/1.1Host: www.vacalinda.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ngvm/?w6A=UyLqygKx2FmdGYSRh5mqmU7zHOPmyh0H52xSnc3cVgCKFPBqoRmOJ0eYguKTgHZNEA4k&3fox=SBZ4 HTTP/1.1Host: www.servicesbackyard.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ngvm/?w6A=HBVp1ZFUGcT+hxfW3ntFEbmU5GO8vrkA1mLmG5vd048TCTgwy52mAcu3AE2RaU7PuRfb&3fox=SBZ4 HTTP/1.1Host: www.djspencer.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ngvm/?w6A=uz7CW46zGnQqpjgqznnFmpPrWAklZoEybcG+oUJN9dvYL4OpOEr/HbmCuGHk2zZbqVpb&3fox=SBZ4 HTTP/1.1Host: www.caravansforsalenorthwales.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 168.235.88.209 168.235.88.209
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: DIGITALOCEAN-ASNUS DIGITALOCEAN-ASNUS
Source: global traffic HTTP traffic detected: GET /ngvm/?w6A=st23zvU/E1xU5Qy7Hp2PD30UnMfCa5knANSLf3ItiB6oVvQd6+qg6yvUWRtcyiXbPLds&3fox=SBZ4 HTTP/1.1Host: www.vacalinda.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ngvm/?w6A=UyLqygKx2FmdGYSRh5mqmU7zHOPmyh0H52xSnc3cVgCKFPBqoRmOJ0eYguKTgHZNEA4k&3fox=SBZ4 HTTP/1.1Host: www.servicesbackyard.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ngvm/?w6A=HBVp1ZFUGcT+hxfW3ntFEbmU5GO8vrkA1mLmG5vd048TCTgwy52mAcu3AE2RaU7PuRfb&3fox=SBZ4 HTTP/1.1Host: www.djspencer.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /ngvm/?w6A=uz7CW46zGnQqpjgqznnFmpPrWAklZoEybcG+oUJN9dvYL4OpOEr/HbmCuGHk2zZbqVpb&3fox=SBZ4 HTTP/1.1Host: www.caravansforsalenorthwales.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.vacalinda.com
Source: explorer.exe, 00000003.00000000.227112576.0000000008A06000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: SX365783909782021.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: SX365783909782021.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-jones.html
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000003.00000000.227163717.0000000008B46000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00405042 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00405042

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.473754310.0000000003200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.209804420.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.258786803.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.211210535.00000000022B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.258837957.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.472090660.0000000000C30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.2.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SX365783909782021.exe.22b0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SX365783909782021.exe.22b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.473754310.0000000003200000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.473754310.0000000003200000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000001.209804420.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000001.209804420.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.258786803.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.258786803.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.211210535.00000000022B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.211210535.00000000022B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.258837957.0000000000710000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.258837957.0000000000710000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000002.472090660.0000000000C30000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000002.472090660.0000000000C30000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.1.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.1.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SX365783909782021.exe.22b0000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SX365783909782021.exe.22b0000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.SX365783909782021.exe.22b0000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.SX365783909782021.exe.22b0000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041A060 NtClose, 2_2_0041A060
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041A110 NtAllocateVirtualMemory, 2_2_0041A110
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00419F30 NtCreateFile, 2_2_00419F30
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00419FE0 NtReadFile, 2_2_00419FE0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041A05A NtClose, 2_2_0041A05A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041A10A NtAllocateVirtualMemory, 2_2_0041A10A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00419F2D NtCreateFile, 2_2_00419F2D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C098F0 NtReadVirtualMemory,LdrInitializeThunk, 2_2_00C098F0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09840 NtDelayExecution,LdrInitializeThunk, 2_2_00C09840
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09860 NtQuerySystemInformation,LdrInitializeThunk, 2_2_00C09860
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C099A0 NtCreateSection,LdrInitializeThunk, 2_2_00C099A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09910 NtAdjustPrivilegesToken,LdrInitializeThunk, 2_2_00C09910
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09A50 NtCreateFile,LdrInitializeThunk, 2_2_00C09A50
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09A00 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_00C09A00
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09A20 NtResumeThread,LdrInitializeThunk, 2_2_00C09A20
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C095D0 NtClose,LdrInitializeThunk, 2_2_00C095D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09540 NtReadFile,LdrInitializeThunk, 2_2_00C09540
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C096E0 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_00C096E0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09660 NtAllocateVirtualMemory,LdrInitializeThunk, 2_2_00C09660
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09780 NtMapViewOfSection,LdrInitializeThunk, 2_2_00C09780
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C097A0 NtUnmapViewOfSection,LdrInitializeThunk, 2_2_00C097A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09710 NtQueryInformationToken,LdrInitializeThunk, 2_2_00C09710
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C098A0 NtWriteVirtualMemory, 2_2_00C098A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C0B040 NtSuspendThread, 2_2_00C0B040
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09820 NtEnumerateKey, 2_2_00C09820
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C099D0 NtCreateProcessEx, 2_2_00C099D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09950 NtQueueApcThread, 2_2_00C09950
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09A80 NtOpenDirectoryObject, 2_2_00C09A80
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09A10 NtQuerySection, 2_2_00C09A10
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C0A3B0 NtGetContextThread, 2_2_00C0A3B0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09B00 NtSetValueKey, 2_2_00C09B00
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C095F0 NtQueryInformationFile, 2_2_00C095F0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09560 NtWriteFile, 2_2_00C09560
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09520 NtWaitForSingleObject, 2_2_00C09520
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C0AD30 NtSetContextThread, 2_2_00C0AD30
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C096D0 NtCreateKey, 2_2_00C096D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09650 NtQueryValueKey, 2_2_00C09650
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09670 NtQueryInformationProcess, 2_2_00C09670
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09610 NtEnumerateValueKey, 2_2_00C09610
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09FE0 NtCreateMutant, 2_2_00C09FE0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09760 NtOpenProcess, 2_2_00C09760
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09770 NtSetInformationFile, 2_2_00C09770
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C0A770 NtOpenThread, 2_2_00C0A770
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C0A710 NtOpenProcessToken, 2_2_00C0A710
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C09730 NtQueryVirtualMemory, 2_2_00C09730
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041A060 NtClose, 2_1_0041A060
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041A110 NtAllocateVirtualMemory, 2_1_0041A110
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00419F30 NtCreateFile, 2_1_00419F30
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00419FE0 NtReadFile, 2_1_00419FE0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041A05A NtClose, 2_1_0041A05A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041A10A NtAllocateVirtualMemory, 2_1_0041A10A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00419F2D NtCreateFile, 2_1_00419F2D
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669A50 NtCreateFile,LdrInitializeThunk, 5_2_03669A50
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669910 NtAdjustPrivilegesToken,LdrInitializeThunk, 5_2_03669910
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036699A0 NtCreateSection,LdrInitializeThunk, 5_2_036699A0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669860 NtQuerySystemInformation,LdrInitializeThunk, 5_2_03669860
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669840 NtDelayExecution,LdrInitializeThunk, 5_2_03669840
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669710 NtQueryInformationToken,LdrInitializeThunk, 5_2_03669710
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669FE0 NtCreateMutant,LdrInitializeThunk, 5_2_03669FE0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669780 NtMapViewOfSection,LdrInitializeThunk, 5_2_03669780
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669660 NtAllocateVirtualMemory,LdrInitializeThunk, 5_2_03669660
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669650 NtQueryValueKey,LdrInitializeThunk, 5_2_03669650
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036696E0 NtFreeVirtualMemory,LdrInitializeThunk, 5_2_036696E0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036696D0 NtCreateKey,LdrInitializeThunk, 5_2_036696D0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669540 NtReadFile,LdrInitializeThunk, 5_2_03669540
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036695D0 NtClose,LdrInitializeThunk, 5_2_036695D0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669B00 NtSetValueKey, 5_2_03669B00
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0366A3B0 NtGetContextThread, 5_2_0366A3B0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669A20 NtResumeThread, 5_2_03669A20
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669A00 NtProtectVirtualMemory, 5_2_03669A00
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669A10 NtQuerySection, 5_2_03669A10
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669A80 NtOpenDirectoryObject, 5_2_03669A80
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669950 NtQueueApcThread, 5_2_03669950
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036699D0 NtCreateProcessEx, 5_2_036699D0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0366B040 NtSuspendThread, 5_2_0366B040
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669820 NtEnumerateKey, 5_2_03669820
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036698F0 NtReadVirtualMemory, 5_2_036698F0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036698A0 NtWriteVirtualMemory, 5_2_036698A0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669760 NtOpenProcess, 5_2_03669760
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0366A770 NtOpenThread, 5_2_0366A770
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669770 NtSetInformationFile, 5_2_03669770
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669730 NtQueryVirtualMemory, 5_2_03669730
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0366A710 NtOpenProcessToken, 5_2_0366A710
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036697A0 NtUnmapViewOfSection, 5_2_036697A0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669670 NtQueryInformationProcess, 5_2_03669670
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669610 NtEnumerateValueKey, 5_2_03669610
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669560 NtWriteFile, 5_2_03669560
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03669520 NtWaitForSingleObject, 5_2_03669520
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0366AD30 NtSetContextThread, 5_2_0366AD30
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036695F0 NtQueryInformationFile, 5_2_036695F0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321A110 NtAllocateVirtualMemory, 5_2_0321A110
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321A060 NtClose, 5_2_0321A060
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03219F30 NtCreateFile, 5_2_03219F30
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03219FE0 NtReadFile, 5_2_03219FE0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321A10A NtAllocateVirtualMemory, 5_2_0321A10A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321A05A NtClose, 5_2_0321A05A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03219F2D NtCreateFile, 5_2_03219F2D
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_0040323C EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_0040323C
Detected potential crypto function
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00404853 0_2_00404853
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00406131 0_2_00406131
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_73761A98 0_2_73761A98
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041E206 2_2_0041E206
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041DA32 2_2_0041DA32
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041D330 2_2_0041D330
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041E46E 2_2_0041E46E
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00402D87 2_2_00402D87
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00409E40 2_2_00409E40
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041D666 2_2_0041D666
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00409E3C 2_2_00409E3C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF20A0 2_2_00BF20A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C928EC 2_2_00C928EC
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDB090 2_2_00BDB090
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C920A8 2_2_00C920A8
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA830 2_2_00BEA830
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81002 2_2_00C81002
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C9E824 2_2_00C9E824
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE4120 2_2_00BE4120
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCF900 2_2_00BCF900
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C922AE 2_2_00C922AE
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C7FA2B 2_2_00C7FA2B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFEBB0 2_2_00BFEBB0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C803DA 2_2_00C803DA
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8DBD2 2_2_00C8DBD2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C723E3 2_2_00C723E3
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFABD8 2_2_00BFABD8
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C92B28 2_2_00C92B28
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEAB40 2_2_00BEAB40
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD841F 2_2_00BD841F
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8D466 2_2_00C8D466
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C925DD 2_2_00C925DD
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2581 2_2_00BF2581
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82D82 2_2_00C82D82
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDD5E0 2_2_00BDD5E0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC0D20 2_2_00BC0D20
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C91D55 2_2_00C91D55
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C92D07 2_2_00C92D07
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C92EF7 2_2_00C92EF7
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE6E30 2_2_00BE6E30
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8D616 2_2_00C8D616
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C9DFCE 2_2_00C9DFCE
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C91FF1 2_2_00C91FF1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00401030 2_1_00401030
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041E206 2_1_0041E206
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041DA32 2_1_0041DA32
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041D330 2_1_0041D330
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041E46E 2_1_0041E46E
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00402D87 2_1_00402D87
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00402D90 2_1_00402D90
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00409E40 2_1_00409E40
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041D666 2_1_0041D666
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00409E3C 2_1_00409E3C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00402FB0 2_1_00402FB0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364AB40 5_2_0364AB40
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F2B28 5_2_036F2B28
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E03DA 5_2_036E03DA
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036EDBD2 5_2_036EDBD2
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365EBB0 5_2_0365EBB0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036DFA2B 5_2_036DFA2B
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F22AE 5_2_036F22AE
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03644120 5_2_03644120
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362F900 5_2_0362F900
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036FE824 5_2_036FE824
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A830 5_2_0364A830
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E1002 5_2_036E1002
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F28EC 5_2_036F28EC
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036520A0 5_2_036520A0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F20A8 5_2_036F20A8
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363B090 5_2_0363B090
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F1FF1 5_2_036F1FF1
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036FDFCE 5_2_036FDFCE
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03646E30 5_2_03646E30
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036ED616 5_2_036ED616
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F2EF7 5_2_036F2EF7
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F1D55 5_2_036F1D55
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03620D20 5_2_03620D20
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F2D07 5_2_036F2D07
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363D5E0 5_2_0363D5E0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F25DD 5_2_036F25DD
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03652581 5_2_03652581
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036ED466 5_2_036ED466
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363841F 5_2_0363841F
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321D330 5_2_0321D330
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321DA32 5_2_0321DA32
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321E206 5_2_0321E206
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03202FB0 5_2_03202FB0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03209E3C 5_2_03209E3C
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321D666 5_2_0321D666
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03209E40 5_2_03209E40
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03202D87 5_2_03202D87
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03202D90 5_2_03202D90
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321E46E 5_2_0321E46E
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\help.exe Code function: String function: 0362B150 appears 72 times
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: String function: 00BCB150 appears 133 times
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: String function: 0041BDB0 appears 38 times
Sample file is different than original file name gathered from version info
Source: SX365783909782021.exe, 00000000.00000003.208364508.0000000009C4F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SX365783909782021.exe
Source: SX365783909782021.exe, 00000002.00000002.258899247.0000000000769000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameHelp.Exej% vs SX365783909782021.exe
Source: SX365783909782021.exe, 00000002.00000002.259254145.0000000000E4F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs SX365783909782021.exe
Uses 32bit PE files
Source: SX365783909782021.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.473754310.0000000003200000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.473754310.0000000003200000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000001.209804420.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000001.209804420.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.258786803.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.258786803.00000000005B0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.211210535.00000000022B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.211210535.00000000022B0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.258837957.0000000000710000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.258837957.0000000000710000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000002.472090660.0000000000C30000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000002.472090660.0000000000C30000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.1.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.1.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SX365783909782021.exe.22b0000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SX365783909782021.exe.22b0000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.SX365783909782021.exe.22b0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.SX365783909782021.exe.22b0000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/4@4/4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00404356 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_00404356
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00402020 CoCreateInstance,MultiByteToWideChar, 0_2_00402020
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:4720:120:WilError_01
Source: C:\Users\user\Desktop\SX365783909782021.exe File created: C:\Users\user\AppData\Local\Temp\nsaD9FC.tmp Jump to behavior
Source: SX365783909782021.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\SX365783909782021.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\SX365783909782021.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: SX365783909782021.exe Virustotal: Detection: 31%
Source: SX365783909782021.exe ReversingLabs: Detection: 39%
Source: C:\Users\user\Desktop\SX365783909782021.exe File read: C:\Users\user\Desktop\SX365783909782021.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\SX365783909782021.exe 'C:\Users\user\Desktop\SX365783909782021.exe'
Source: C:\Users\user\Desktop\SX365783909782021.exe Process created: C:\Users\user\Desktop\SX365783909782021.exe 'C:\Users\user\Desktop\SX365783909782021.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\help.exe C:\Windows\SysWOW64\help.exe
Source: C:\Windows\SysWOW64\help.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SX365783909782021.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\SX365783909782021.exe Process created: C:\Users\user\Desktop\SX365783909782021.exe 'C:\Users\user\Desktop\SX365783909782021.exe' Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SX365783909782021.exe' Jump to behavior
Source: C:\Users\user\Desktop\SX365783909782021.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: Binary string: wntdll.pdbUGP source: SX365783909782021.exe, 00000000.00000003.209611066.0000000009B30000.00000004.00000001.sdmp, SX365783909782021.exe, 00000002.00000002.258947287.0000000000BA0000.00000040.00000001.sdmp, help.exe, 00000005.00000002.474720424.000000000371F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: SX365783909782021.exe, help.exe
Source: Binary string: help.pdbGCTL source: SX365783909782021.exe, 00000002.00000002.258899247.0000000000769000.00000004.00000020.sdmp
Source: Binary string: help.pdb source: SX365783909782021.exe, 00000002.00000002.258899247.0000000000769000.00000004.00000020.sdmp

Data Obfuscation:

barindex
Detected unpacking (changes PE section rights)
Source: C:\Users\user\Desktop\SX365783909782021.exe Unpacked PE file: 2.2.SX365783909782021.exe.400000.0.unpack .text:ER;.rdata:R;.data:W;.ndata:W;.rsrc:R; vs .text:ER;
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405E88
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_73762F60 push eax; ret 0_2_73762F8E
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041D0D2 push eax; ret 2_2_0041D0D8
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041D0DB push eax; ret 2_2_0041D142
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041D085 push eax; ret 2_2_0041D0D8
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00419916 push ecx; iretd 2_2_0041991B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041692C push cs; ret 2_2_00416937
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041D13C push eax; ret 2_2_0041D142
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00416B53 push edi; iretd 2_2_00416B54
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0041AB2B pushad ; ret 2_2_0041AB2C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C1D0D1 push ecx; ret 2_2_00C1D0E4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041D0D2 push eax; ret 2_1_0041D0D8
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041D0DB push eax; ret 2_1_0041D142
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041D085 push eax; ret 2_1_0041D0D8
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00419916 push ecx; iretd 2_1_0041991B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041692C push cs; ret 2_1_00416937
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041D13C push eax; ret 2_1_0041D142
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_00416B53 push edi; iretd 2_1_00416B54
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_1_0041AB2B pushad ; ret 2_1_0041AB2C
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0367D0D1 push ecx; ret 5_2_0367D0E4
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321AB2B pushad ; ret 5_2_0321AB2C
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03216B53 push edi; iretd 5_2_03216B54
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321692C push cs; ret 5_2_03216937
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321D13C push eax; ret 5_2_0321D142
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03219916 push ecx; iretd 5_2_0321991B
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321D085 push eax; ret 5_2_0321D0D8
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321D0D2 push eax; ret 5_2_0321D0D8
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0321D0DB push eax; ret 5_2_0321D142

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\SX365783909782021.exe File created: C:\Users\user\AppData\Local\Temp\nsvDA2D.tmp\System.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8A 0xAE 0xED
Source: C:\Users\user\Desktop\SX365783909782021.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\SX365783909782021.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\SX365783909782021.exe RDTSC instruction interceptor: First address: 0000000000409B5E second address: 0000000000409B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe RDTSC instruction interceptor: First address: 00000000032098E4 second address: 00000000032098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\help.exe RDTSC instruction interceptor: First address: 0000000003209B5E second address: 0000000003209B64 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\SX365783909782021.exe File opened / queried: SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00409A90 rdtsc 2_2_00409A90
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 4660 Thread sleep count: 31 > 30 Jump to behavior
Source: C:\Windows\explorer.exe TID: 4660 Thread sleep time: -62000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\help.exe TID: 4740 Thread sleep time: -48000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\help.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00405E61 FindFirstFileA,FindClose, 0_2_00405E61
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_0040548B CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_0040548B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_0040263E FindFirstFileA, 0_2_0040263E
Source: explorer.exe, 00000003.00000000.226628134.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000003.00000000.226628134.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000:
Source: explorer.exe, 00000003.00000000.226481174.0000000008640000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.224813864.0000000008220000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: explorer.exe, 00000003.00000000.219682081.0000000004E61000.00000004.00000001.sdmp Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-s
Source: explorer.exe, 00000003.00000000.247140572.0000000004E61000.00000004.00000001.sdmp Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-
Source: explorer.exe, 00000003.00000000.247457581.00000000055D0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}V*(E
Source: explorer.exe, 00000003.00000000.226628134.000000000871F000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}~
Source: explorer.exe, 00000003.00000000.226628134.000000000871F000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000003.00000000.226715278.00000000087D1000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00ices
Source: explorer.exe, 00000003.00000000.221477185.0000000005603000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b},
Source: explorer.exe, 00000003.00000000.224813864.0000000008220000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: explorer.exe, 00000003.00000000.224813864.0000000008220000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: explorer.exe, 00000003.00000000.226628134.000000000871F000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATAJ
Source: explorer.exe, 00000003.00000000.224813864.0000000008220000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\SX365783909782021.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\SX365783909782021.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00409A90 rdtsc 2_2_00409A90
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_0040ACD0 LdrLoadDll, 2_2_0040ACD0
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00405E88 GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405E88
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFF0BF mov ecx, dword ptr fs:[00000030h] 2_2_00BFF0BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFF0BF mov eax, dword ptr fs:[00000030h] 2_2_00BFF0BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFF0BF mov eax, dword ptr fs:[00000030h] 2_2_00BFF0BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00C5B8D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5B8D0 mov ecx, dword ptr fs:[00000030h] 2_2_00C5B8D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00C5B8D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00C5B8D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00C5B8D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00C5B8D0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF20A0 mov eax, dword ptr fs:[00000030h] 2_2_00BF20A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF20A0 mov eax, dword ptr fs:[00000030h] 2_2_00BF20A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF20A0 mov eax, dword ptr fs:[00000030h] 2_2_00BF20A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF20A0 mov eax, dword ptr fs:[00000030h] 2_2_00BF20A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF20A0 mov eax, dword ptr fs:[00000030h] 2_2_00BF20A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF20A0 mov eax, dword ptr fs:[00000030h] 2_2_00BF20A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC9080 mov eax, dword ptr fs:[00000030h] 2_2_00BC9080
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C43884 mov eax, dword ptr fs:[00000030h] 2_2_00C43884
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C43884 mov eax, dword ptr fs:[00000030h] 2_2_00C43884
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC58EC mov eax, dword ptr fs:[00000030h] 2_2_00BC58EC
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEB8E4 mov eax, dword ptr fs:[00000030h] 2_2_00BEB8E4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEB8E4 mov eax, dword ptr fs:[00000030h] 2_2_00BEB8E4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC40E1 mov eax, dword ptr fs:[00000030h] 2_2_00BC40E1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC40E1 mov eax, dword ptr fs:[00000030h] 2_2_00BC40E1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC40E1 mov eax, dword ptr fs:[00000030h] 2_2_00BC40E1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C090AF mov eax, dword ptr fs:[00000030h] 2_2_00C090AF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA830 mov eax, dword ptr fs:[00000030h] 2_2_00BEA830
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA830 mov eax, dword ptr fs:[00000030h] 2_2_00BEA830
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA830 mov eax, dword ptr fs:[00000030h] 2_2_00BEA830
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA830 mov eax, dword ptr fs:[00000030h] 2_2_00BEA830
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF002D mov eax, dword ptr fs:[00000030h] 2_2_00BF002D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF002D mov eax, dword ptr fs:[00000030h] 2_2_00BF002D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF002D mov eax, dword ptr fs:[00000030h] 2_2_00BF002D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF002D mov eax, dword ptr fs:[00000030h] 2_2_00BF002D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF002D mov eax, dword ptr fs:[00000030h] 2_2_00BF002D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDB02A mov eax, dword ptr fs:[00000030h] 2_2_00BDB02A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDB02A mov eax, dword ptr fs:[00000030h] 2_2_00BDB02A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDB02A mov eax, dword ptr fs:[00000030h] 2_2_00BDB02A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDB02A mov eax, dword ptr fs:[00000030h] 2_2_00BDB02A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82073 mov eax, dword ptr fs:[00000030h] 2_2_00C82073
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C91074 mov eax, dword ptr fs:[00000030h] 2_2_00C91074
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C47016 mov eax, dword ptr fs:[00000030h] 2_2_00C47016
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C47016 mov eax, dword ptr fs:[00000030h] 2_2_00C47016
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C47016 mov eax, dword ptr fs:[00000030h] 2_2_00C47016
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C94015 mov eax, dword ptr fs:[00000030h] 2_2_00C94015
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C94015 mov eax, dword ptr fs:[00000030h] 2_2_00C94015
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE0050 mov eax, dword ptr fs:[00000030h] 2_2_00BE0050
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE0050 mov eax, dword ptr fs:[00000030h] 2_2_00BE0050
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov ecx, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov ecx, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov eax, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov ecx, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov ecx, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov eax, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov ecx, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov ecx, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov eax, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov ecx, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov ecx, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE99BF mov eax, dword ptr fs:[00000030h] 2_2_00BE99BF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF61A0 mov eax, dword ptr fs:[00000030h] 2_2_00BF61A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF61A0 mov eax, dword ptr fs:[00000030h] 2_2_00BF61A0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C541E8 mov eax, dword ptr fs:[00000030h] 2_2_00C541E8
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2990 mov eax, dword ptr fs:[00000030h] 2_2_00BF2990
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFA185 mov eax, dword ptr fs:[00000030h] 2_2_00BFA185
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEC182 mov eax, dword ptr fs:[00000030h] 2_2_00BEC182
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00BCB1E1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00BCB1E1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00BCB1E1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C469A6 mov eax, dword ptr fs:[00000030h] 2_2_00C469A6
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C849A4 mov eax, dword ptr fs:[00000030h] 2_2_00C849A4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C849A4 mov eax, dword ptr fs:[00000030h] 2_2_00C849A4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C849A4 mov eax, dword ptr fs:[00000030h] 2_2_00C849A4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C849A4 mov eax, dword ptr fs:[00000030h] 2_2_00C849A4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C451BE mov eax, dword ptr fs:[00000030h] 2_2_00C451BE
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C451BE mov eax, dword ptr fs:[00000030h] 2_2_00C451BE
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C451BE mov eax, dword ptr fs:[00000030h] 2_2_00C451BE
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C451BE mov eax, dword ptr fs:[00000030h] 2_2_00C451BE
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF513A mov eax, dword ptr fs:[00000030h] 2_2_00BF513A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF513A mov eax, dword ptr fs:[00000030h] 2_2_00BF513A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE4120 mov eax, dword ptr fs:[00000030h] 2_2_00BE4120
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE4120 mov eax, dword ptr fs:[00000030h] 2_2_00BE4120
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE4120 mov eax, dword ptr fs:[00000030h] 2_2_00BE4120
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE4120 mov eax, dword ptr fs:[00000030h] 2_2_00BE4120
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE4120 mov ecx, dword ptr fs:[00000030h] 2_2_00BE4120
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC9100 mov eax, dword ptr fs:[00000030h] 2_2_00BC9100
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC9100 mov eax, dword ptr fs:[00000030h] 2_2_00BC9100
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC9100 mov eax, dword ptr fs:[00000030h] 2_2_00BC9100
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCB171 mov eax, dword ptr fs:[00000030h] 2_2_00BCB171
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCB171 mov eax, dword ptr fs:[00000030h] 2_2_00BCB171
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCC962 mov eax, dword ptr fs:[00000030h] 2_2_00BCC962
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEB944 mov eax, dword ptr fs:[00000030h] 2_2_00BEB944
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEB944 mov eax, dword ptr fs:[00000030h] 2_2_00BEB944
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDAAB0 mov eax, dword ptr fs:[00000030h] 2_2_00BDAAB0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDAAB0 mov eax, dword ptr fs:[00000030h] 2_2_00BDAAB0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFFAB0 mov eax, dword ptr fs:[00000030h] 2_2_00BFFAB0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC52A5 mov eax, dword ptr fs:[00000030h] 2_2_00BC52A5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC52A5 mov eax, dword ptr fs:[00000030h] 2_2_00BC52A5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC52A5 mov eax, dword ptr fs:[00000030h] 2_2_00BC52A5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC52A5 mov eax, dword ptr fs:[00000030h] 2_2_00BC52A5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC52A5 mov eax, dword ptr fs:[00000030h] 2_2_00BC52A5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84AEF mov eax, dword ptr fs:[00000030h] 2_2_00C84AEF
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFD294 mov eax, dword ptr fs:[00000030h] 2_2_00BFD294
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFD294 mov eax, dword ptr fs:[00000030h] 2_2_00BFD294
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2AE4 mov eax, dword ptr fs:[00000030h] 2_2_00BF2AE4
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2ACB mov eax, dword ptr fs:[00000030h] 2_2_00BF2ACB
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C54257 mov eax, dword ptr fs:[00000030h] 2_2_00C54257
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA229 mov eax, dword ptr fs:[00000030h] 2_2_00BEA229
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8EA55 mov eax, dword ptr fs:[00000030h] 2_2_00C8EA55
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE3A1C mov eax, dword ptr fs:[00000030h] 2_2_00BE3A1C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C7B260 mov eax, dword ptr fs:[00000030h] 2_2_00C7B260
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C7B260 mov eax, dword ptr fs:[00000030h] 2_2_00C7B260
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCAA16 mov eax, dword ptr fs:[00000030h] 2_2_00BCAA16
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCAA16 mov eax, dword ptr fs:[00000030h] 2_2_00BCAA16
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C98A62 mov eax, dword ptr fs:[00000030h] 2_2_00C98A62
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC5210 mov eax, dword ptr fs:[00000030h] 2_2_00BC5210
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC5210 mov ecx, dword ptr fs:[00000030h] 2_2_00BC5210
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC5210 mov eax, dword ptr fs:[00000030h] 2_2_00BC5210
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC5210 mov eax, dword ptr fs:[00000030h] 2_2_00BC5210
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD8A0A mov eax, dword ptr fs:[00000030h] 2_2_00BD8A0A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C0927A mov eax, dword ptr fs:[00000030h] 2_2_00C0927A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8AA16 mov eax, dword ptr fs:[00000030h] 2_2_00C8AA16
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8AA16 mov eax, dword ptr fs:[00000030h] 2_2_00C8AA16
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C04A2C mov eax, dword ptr fs:[00000030h] 2_2_00C04A2C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C04A2C mov eax, dword ptr fs:[00000030h] 2_2_00C04A2C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC9240 mov eax, dword ptr fs:[00000030h] 2_2_00BC9240
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC9240 mov eax, dword ptr fs:[00000030h] 2_2_00BC9240
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC9240 mov eax, dword ptr fs:[00000030h] 2_2_00BC9240
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC9240 mov eax, dword ptr fs:[00000030h] 2_2_00BC9240
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C453CA mov eax, dword ptr fs:[00000030h] 2_2_00C453CA
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C453CA mov eax, dword ptr fs:[00000030h] 2_2_00C453CA
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF4BAD mov eax, dword ptr fs:[00000030h] 2_2_00BF4BAD
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF4BAD mov eax, dword ptr fs:[00000030h] 2_2_00BF4BAD
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF4BAD mov eax, dword ptr fs:[00000030h] 2_2_00BF4BAD
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C723E3 mov ecx, dword ptr fs:[00000030h] 2_2_00C723E3
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C723E3 mov ecx, dword ptr fs:[00000030h] 2_2_00C723E3
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C723E3 mov eax, dword ptr fs:[00000030h] 2_2_00C723E3
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2397 mov eax, dword ptr fs:[00000030h] 2_2_00BF2397
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFB390 mov eax, dword ptr fs:[00000030h] 2_2_00BFB390
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD1B8F mov eax, dword ptr fs:[00000030h] 2_2_00BD1B8F
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD1B8F mov eax, dword ptr fs:[00000030h] 2_2_00BD1B8F
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8138A mov eax, dword ptr fs:[00000030h] 2_2_00C8138A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C7D380 mov ecx, dword ptr fs:[00000030h] 2_2_00C7D380
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEDBE9 mov eax, dword ptr fs:[00000030h] 2_2_00BEDBE9
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF03E2 mov eax, dword ptr fs:[00000030h] 2_2_00BF03E2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF03E2 mov eax, dword ptr fs:[00000030h] 2_2_00BF03E2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF03E2 mov eax, dword ptr fs:[00000030h] 2_2_00BF03E2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF03E2 mov eax, dword ptr fs:[00000030h] 2_2_00BF03E2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF03E2 mov eax, dword ptr fs:[00000030h] 2_2_00BF03E2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF03E2 mov eax, dword ptr fs:[00000030h] 2_2_00BF03E2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C95BA5 mov eax, dword ptr fs:[00000030h] 2_2_00C95BA5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C98B58 mov eax, dword ptr fs:[00000030h] 2_2_00C98B58
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEA309 mov eax, dword ptr fs:[00000030h] 2_2_00BEA309
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF3B7A mov eax, dword ptr fs:[00000030h] 2_2_00BF3B7A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF3B7A mov eax, dword ptr fs:[00000030h] 2_2_00BF3B7A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8131B mov eax, dword ptr fs:[00000030h] 2_2_00C8131B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCDB60 mov ecx, dword ptr fs:[00000030h] 2_2_00BCDB60
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCF358 mov eax, dword ptr fs:[00000030h] 2_2_00BCF358
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCDB40 mov eax, dword ptr fs:[00000030h] 2_2_00BCDB40
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C98CD6 mov eax, dword ptr fs:[00000030h] 2_2_00C98CD6
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD849B mov eax, dword ptr fs:[00000030h] 2_2_00BD849B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C814FB mov eax, dword ptr fs:[00000030h] 2_2_00C814FB
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46CF0 mov eax, dword ptr fs:[00000030h] 2_2_00C46CF0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46CF0 mov eax, dword ptr fs:[00000030h] 2_2_00C46CF0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46CF0 mov eax, dword ptr fs:[00000030h] 2_2_00C46CF0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C84496 mov eax, dword ptr fs:[00000030h] 2_2_00C84496
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFBC2C mov eax, dword ptr fs:[00000030h] 2_2_00BFBC2C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5C450 mov eax, dword ptr fs:[00000030h] 2_2_00C5C450
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5C450 mov eax, dword ptr fs:[00000030h] 2_2_00C5C450
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C9740D mov eax, dword ptr fs:[00000030h] 2_2_00C9740D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C9740D mov eax, dword ptr fs:[00000030h] 2_2_00C9740D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C9740D mov eax, dword ptr fs:[00000030h] 2_2_00C9740D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFAC7B mov eax, dword ptr fs:[00000030h] 2_2_00BFAC7B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81C06 mov eax, dword ptr fs:[00000030h] 2_2_00C81C06
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46C0A mov eax, dword ptr fs:[00000030h] 2_2_00C46C0A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46C0A mov eax, dword ptr fs:[00000030h] 2_2_00C46C0A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46C0A mov eax, dword ptr fs:[00000030h] 2_2_00C46C0A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46C0A mov eax, dword ptr fs:[00000030h] 2_2_00C46C0A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE746D mov eax, dword ptr fs:[00000030h] 2_2_00BE746D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFA44B mov eax, dword ptr fs:[00000030h] 2_2_00BFA44B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF1DB5 mov eax, dword ptr fs:[00000030h] 2_2_00BF1DB5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF1DB5 mov eax, dword ptr fs:[00000030h] 2_2_00BF1DB5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF1DB5 mov eax, dword ptr fs:[00000030h] 2_2_00BF1DB5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46DC9 mov eax, dword ptr fs:[00000030h] 2_2_00C46DC9
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46DC9 mov eax, dword ptr fs:[00000030h] 2_2_00C46DC9
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46DC9 mov eax, dword ptr fs:[00000030h] 2_2_00C46DC9
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46DC9 mov ecx, dword ptr fs:[00000030h] 2_2_00C46DC9
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46DC9 mov eax, dword ptr fs:[00000030h] 2_2_00C46DC9
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C46DC9 mov eax, dword ptr fs:[00000030h] 2_2_00C46DC9
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF35A1 mov eax, dword ptr fs:[00000030h] 2_2_00BF35A1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFFD9B mov eax, dword ptr fs:[00000030h] 2_2_00BFFD9B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFFD9B mov eax, dword ptr fs:[00000030h] 2_2_00BFFD9B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00C8FDE2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00C8FDE2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00C8FDE2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00C8FDE2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C78DF1 mov eax, dword ptr fs:[00000030h] 2_2_00C78DF1
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC2D8A mov eax, dword ptr fs:[00000030h] 2_2_00BC2D8A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC2D8A mov eax, dword ptr fs:[00000030h] 2_2_00BC2D8A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC2D8A mov eax, dword ptr fs:[00000030h] 2_2_00BC2D8A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC2D8A mov eax, dword ptr fs:[00000030h] 2_2_00BC2D8A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC2D8A mov eax, dword ptr fs:[00000030h] 2_2_00BC2D8A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2581 mov eax, dword ptr fs:[00000030h] 2_2_00BF2581
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2581 mov eax, dword ptr fs:[00000030h] 2_2_00BF2581
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2581 mov eax, dword ptr fs:[00000030h] 2_2_00BF2581
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF2581 mov eax, dword ptr fs:[00000030h] 2_2_00BF2581
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82D82 mov eax, dword ptr fs:[00000030h] 2_2_00C82D82
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82D82 mov eax, dword ptr fs:[00000030h] 2_2_00C82D82
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82D82 mov eax, dword ptr fs:[00000030h] 2_2_00C82D82
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82D82 mov eax, dword ptr fs:[00000030h] 2_2_00C82D82
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82D82 mov eax, dword ptr fs:[00000030h] 2_2_00C82D82
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82D82 mov eax, dword ptr fs:[00000030h] 2_2_00C82D82
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C82D82 mov eax, dword ptr fs:[00000030h] 2_2_00C82D82
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDD5E0 mov eax, dword ptr fs:[00000030h] 2_2_00BDD5E0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDD5E0 mov eax, dword ptr fs:[00000030h] 2_2_00BDD5E0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C905AC mov eax, dword ptr fs:[00000030h] 2_2_00C905AC
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C905AC mov eax, dword ptr fs:[00000030h] 2_2_00C905AC
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C03D43 mov eax, dword ptr fs:[00000030h] 2_2_00C03D43
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF4D3B mov eax, dword ptr fs:[00000030h] 2_2_00BF4D3B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF4D3B mov eax, dword ptr fs:[00000030h] 2_2_00BF4D3B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF4D3B mov eax, dword ptr fs:[00000030h] 2_2_00BF4D3B
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C43540 mov eax, dword ptr fs:[00000030h] 2_2_00C43540
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C73D40 mov eax, dword ptr fs:[00000030h] 2_2_00C73D40
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD3D34 mov eax, dword ptr fs:[00000030h] 2_2_00BD3D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCAD30 mov eax, dword ptr fs:[00000030h] 2_2_00BCAD30
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEC577 mov eax, dword ptr fs:[00000030h] 2_2_00BEC577
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEC577 mov eax, dword ptr fs:[00000030h] 2_2_00BEC577
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BE7D50 mov eax, dword ptr fs:[00000030h] 2_2_00BE7D50
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8E539 mov eax, dword ptr fs:[00000030h] 2_2_00C8E539
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C4A537 mov eax, dword ptr fs:[00000030h] 2_2_00C4A537
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C98D34 mov eax, dword ptr fs:[00000030h] 2_2_00C98D34
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C7FEC0 mov eax, dword ptr fs:[00000030h] 2_2_00C7FEC0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C08EC7 mov eax, dword ptr fs:[00000030h] 2_2_00C08EC7
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C98ED6 mov eax, dword ptr fs:[00000030h] 2_2_00C98ED6
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5FE87 mov eax, dword ptr fs:[00000030h] 2_2_00C5FE87
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF16E0 mov ecx, dword ptr fs:[00000030h] 2_2_00BF16E0
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD76E2 mov eax, dword ptr fs:[00000030h] 2_2_00BD76E2
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C446A7 mov eax, dword ptr fs:[00000030h] 2_2_00C446A7
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C90EA5 mov eax, dword ptr fs:[00000030h] 2_2_00C90EA5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C90EA5 mov eax, dword ptr fs:[00000030h] 2_2_00C90EA5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C90EA5 mov eax, dword ptr fs:[00000030h] 2_2_00C90EA5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF36CC mov eax, dword ptr fs:[00000030h] 2_2_00BF36CC
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8AE44 mov eax, dword ptr fs:[00000030h] 2_2_00C8AE44
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C8AE44 mov eax, dword ptr fs:[00000030h] 2_2_00C8AE44
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCE620 mov eax, dword ptr fs:[00000030h] 2_2_00BCE620
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFA61C mov eax, dword ptr fs:[00000030h] 2_2_00BFA61C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFA61C mov eax, dword ptr fs:[00000030h] 2_2_00BFA61C
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCC600 mov eax, dword ptr fs:[00000030h] 2_2_00BCC600
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCC600 mov eax, dword ptr fs:[00000030h] 2_2_00BCC600
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BCC600 mov eax, dword ptr fs:[00000030h] 2_2_00BCC600
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BF8E00 mov eax, dword ptr fs:[00000030h] 2_2_00BF8E00
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C81608 mov eax, dword ptr fs:[00000030h] 2_2_00C81608
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEAE73 mov eax, dword ptr fs:[00000030h] 2_2_00BEAE73
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEAE73 mov eax, dword ptr fs:[00000030h] 2_2_00BEAE73
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEAE73 mov eax, dword ptr fs:[00000030h] 2_2_00BEAE73
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEAE73 mov eax, dword ptr fs:[00000030h] 2_2_00BEAE73
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEAE73 mov eax, dword ptr fs:[00000030h] 2_2_00BEAE73
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD766D mov eax, dword ptr fs:[00000030h] 2_2_00BD766D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C7FE3F mov eax, dword ptr fs:[00000030h] 2_2_00C7FE3F
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD7E41 mov eax, dword ptr fs:[00000030h] 2_2_00BD7E41
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD7E41 mov eax, dword ptr fs:[00000030h] 2_2_00BD7E41
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD7E41 mov eax, dword ptr fs:[00000030h] 2_2_00BD7E41
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD7E41 mov eax, dword ptr fs:[00000030h] 2_2_00BD7E41
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD7E41 mov eax, dword ptr fs:[00000030h] 2_2_00BD7E41
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD7E41 mov eax, dword ptr fs:[00000030h] 2_2_00BD7E41
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BD8794 mov eax, dword ptr fs:[00000030h] 2_2_00BD8794
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C037F5 mov eax, dword ptr fs:[00000030h] 2_2_00C037F5
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C47794 mov eax, dword ptr fs:[00000030h] 2_2_00C47794
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C47794 mov eax, dword ptr fs:[00000030h] 2_2_00C47794
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C47794 mov eax, dword ptr fs:[00000030h] 2_2_00C47794
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEB73D mov eax, dword ptr fs:[00000030h] 2_2_00BEB73D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEB73D mov eax, dword ptr fs:[00000030h] 2_2_00BEB73D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFE730 mov eax, dword ptr fs:[00000030h] 2_2_00BFE730
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC4F2E mov eax, dword ptr fs:[00000030h] 2_2_00BC4F2E
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BC4F2E mov eax, dword ptr fs:[00000030h] 2_2_00BC4F2E
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C98F6A mov eax, dword ptr fs:[00000030h] 2_2_00C98F6A
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BEF716 mov eax, dword ptr fs:[00000030h] 2_2_00BEF716
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFA70E mov eax, dword ptr fs:[00000030h] 2_2_00BFA70E
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BFA70E mov eax, dword ptr fs:[00000030h] 2_2_00BFA70E
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C9070D mov eax, dword ptr fs:[00000030h] 2_2_00C9070D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C9070D mov eax, dword ptr fs:[00000030h] 2_2_00C9070D
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5FF10 mov eax, dword ptr fs:[00000030h] 2_2_00C5FF10
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00C5FF10 mov eax, dword ptr fs:[00000030h] 2_2_00C5FF10
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDFF60 mov eax, dword ptr fs:[00000030h] 2_2_00BDFF60
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 2_2_00BDEF40 mov eax, dword ptr fs:[00000030h] 2_2_00BDEF40
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362DB60 mov ecx, dword ptr fs:[00000030h] 5_2_0362DB60
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03653B7A mov eax, dword ptr fs:[00000030h] 5_2_03653B7A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03653B7A mov eax, dword ptr fs:[00000030h] 5_2_03653B7A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362DB40 mov eax, dword ptr fs:[00000030h] 5_2_0362DB40
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F8B58 mov eax, dword ptr fs:[00000030h] 5_2_036F8B58
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362F358 mov eax, dword ptr fs:[00000030h] 5_2_0362F358
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E131B mov eax, dword ptr fs:[00000030h] 5_2_036E131B
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036503E2 mov eax, dword ptr fs:[00000030h] 5_2_036503E2
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036503E2 mov eax, dword ptr fs:[00000030h] 5_2_036503E2
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036503E2 mov eax, dword ptr fs:[00000030h] 5_2_036503E2
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036503E2 mov eax, dword ptr fs:[00000030h] 5_2_036503E2
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036503E2 mov eax, dword ptr fs:[00000030h] 5_2_036503E2
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036503E2 mov eax, dword ptr fs:[00000030h] 5_2_036503E2
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364DBE9 mov eax, dword ptr fs:[00000030h] 5_2_0364DBE9
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036A53CA mov eax, dword ptr fs:[00000030h] 5_2_036A53CA
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036A53CA mov eax, dword ptr fs:[00000030h] 5_2_036A53CA
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03654BAD mov eax, dword ptr fs:[00000030h] 5_2_03654BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03654BAD mov eax, dword ptr fs:[00000030h] 5_2_03654BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03654BAD mov eax, dword ptr fs:[00000030h] 5_2_03654BAD
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F5BA5 mov eax, dword ptr fs:[00000030h] 5_2_036F5BA5
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E138A mov eax, dword ptr fs:[00000030h] 5_2_036E138A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03631B8F mov eax, dword ptr fs:[00000030h] 5_2_03631B8F
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03631B8F mov eax, dword ptr fs:[00000030h] 5_2_03631B8F
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036DD380 mov ecx, dword ptr fs:[00000030h] 5_2_036DD380
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03652397 mov eax, dword ptr fs:[00000030h] 5_2_03652397
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365B390 mov eax, dword ptr fs:[00000030h] 5_2_0365B390
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036DB260 mov eax, dword ptr fs:[00000030h] 5_2_036DB260
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036DB260 mov eax, dword ptr fs:[00000030h] 5_2_036DB260
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F8A62 mov eax, dword ptr fs:[00000030h] 5_2_036F8A62
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0366927A mov eax, dword ptr fs:[00000030h] 5_2_0366927A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03629240 mov eax, dword ptr fs:[00000030h] 5_2_03629240
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03629240 mov eax, dword ptr fs:[00000030h] 5_2_03629240
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03629240 mov eax, dword ptr fs:[00000030h] 5_2_03629240
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03629240 mov eax, dword ptr fs:[00000030h] 5_2_03629240
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036EEA55 mov eax, dword ptr fs:[00000030h] 5_2_036EEA55
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036B4257 mov eax, dword ptr fs:[00000030h] 5_2_036B4257
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03664A2C mov eax, dword ptr fs:[00000030h] 5_2_03664A2C
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03664A2C mov eax, dword ptr fs:[00000030h] 5_2_03664A2C
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A229 mov eax, dword ptr fs:[00000030h] 5_2_0364A229
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03638A0A mov eax, dword ptr fs:[00000030h] 5_2_03638A0A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03625210 mov eax, dword ptr fs:[00000030h] 5_2_03625210
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03625210 mov ecx, dword ptr fs:[00000030h] 5_2_03625210
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03625210 mov eax, dword ptr fs:[00000030h] 5_2_03625210
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03625210 mov eax, dword ptr fs:[00000030h] 5_2_03625210
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362AA16 mov eax, dword ptr fs:[00000030h] 5_2_0362AA16
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362AA16 mov eax, dword ptr fs:[00000030h] 5_2_0362AA16
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03643A1C mov eax, dword ptr fs:[00000030h] 5_2_03643A1C
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036EAA16 mov eax, dword ptr fs:[00000030h] 5_2_036EAA16
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036EAA16 mov eax, dword ptr fs:[00000030h] 5_2_036EAA16
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03652AE4 mov eax, dword ptr fs:[00000030h] 5_2_03652AE4
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03652ACB mov eax, dword ptr fs:[00000030h] 5_2_03652ACB
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036252A5 mov eax, dword ptr fs:[00000030h] 5_2_036252A5
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036252A5 mov eax, dword ptr fs:[00000030h] 5_2_036252A5
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036252A5 mov eax, dword ptr fs:[00000030h] 5_2_036252A5
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036252A5 mov eax, dword ptr fs:[00000030h] 5_2_036252A5
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036252A5 mov eax, dword ptr fs:[00000030h] 5_2_036252A5
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363AAB0 mov eax, dword ptr fs:[00000030h] 5_2_0363AAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363AAB0 mov eax, dword ptr fs:[00000030h] 5_2_0363AAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365FAB0 mov eax, dword ptr fs:[00000030h] 5_2_0365FAB0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365D294 mov eax, dword ptr fs:[00000030h] 5_2_0365D294
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365D294 mov eax, dword ptr fs:[00000030h] 5_2_0365D294
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362C962 mov eax, dword ptr fs:[00000030h] 5_2_0362C962
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362B171 mov eax, dword ptr fs:[00000030h] 5_2_0362B171
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362B171 mov eax, dword ptr fs:[00000030h] 5_2_0362B171
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364B944 mov eax, dword ptr fs:[00000030h] 5_2_0364B944
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364B944 mov eax, dword ptr fs:[00000030h] 5_2_0364B944
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03644120 mov eax, dword ptr fs:[00000030h] 5_2_03644120
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03644120 mov eax, dword ptr fs:[00000030h] 5_2_03644120
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03644120 mov eax, dword ptr fs:[00000030h] 5_2_03644120
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03644120 mov eax, dword ptr fs:[00000030h] 5_2_03644120
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03644120 mov ecx, dword ptr fs:[00000030h] 5_2_03644120
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365513A mov eax, dword ptr fs:[00000030h] 5_2_0365513A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365513A mov eax, dword ptr fs:[00000030h] 5_2_0365513A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03629100 mov eax, dword ptr fs:[00000030h] 5_2_03629100
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03629100 mov eax, dword ptr fs:[00000030h] 5_2_03629100
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03629100 mov eax, dword ptr fs:[00000030h] 5_2_03629100
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036B41E8 mov eax, dword ptr fs:[00000030h] 5_2_036B41E8
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362B1E1 mov eax, dword ptr fs:[00000030h] 5_2_0362B1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362B1E1 mov eax, dword ptr fs:[00000030h] 5_2_0362B1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0362B1E1 mov eax, dword ptr fs:[00000030h] 5_2_0362B1E1
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036561A0 mov eax, dword ptr fs:[00000030h] 5_2_036561A0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036561A0 mov eax, dword ptr fs:[00000030h] 5_2_036561A0
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E49A4 mov eax, dword ptr fs:[00000030h] 5_2_036E49A4
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E49A4 mov eax, dword ptr fs:[00000030h] 5_2_036E49A4
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E49A4 mov eax, dword ptr fs:[00000030h] 5_2_036E49A4
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E49A4 mov eax, dword ptr fs:[00000030h] 5_2_036E49A4
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036A69A6 mov eax, dword ptr fs:[00000030h] 5_2_036A69A6
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036A51BE mov eax, dword ptr fs:[00000030h] 5_2_036A51BE
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036A51BE mov eax, dword ptr fs:[00000030h] 5_2_036A51BE
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036A51BE mov eax, dword ptr fs:[00000030h] 5_2_036A51BE
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036A51BE mov eax, dword ptr fs:[00000030h] 5_2_036A51BE
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov ecx, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov ecx, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov eax, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov ecx, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov ecx, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov eax, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov ecx, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov ecx, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov eax, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov ecx, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov ecx, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036499BF mov eax, dword ptr fs:[00000030h] 5_2_036499BF
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365A185 mov eax, dword ptr fs:[00000030h] 5_2_0365A185
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364C182 mov eax, dword ptr fs:[00000030h] 5_2_0364C182
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03652990 mov eax, dword ptr fs:[00000030h] 5_2_03652990
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036F1074 mov eax, dword ptr fs:[00000030h] 5_2_036F1074
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_036E2073 mov eax, dword ptr fs:[00000030h] 5_2_036E2073
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03640050 mov eax, dword ptr fs:[00000030h] 5_2_03640050
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_03640050 mov eax, dword ptr fs:[00000030h] 5_2_03640050
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365002D mov eax, dword ptr fs:[00000030h] 5_2_0365002D
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365002D mov eax, dword ptr fs:[00000030h] 5_2_0365002D
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365002D mov eax, dword ptr fs:[00000030h] 5_2_0365002D
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365002D mov eax, dword ptr fs:[00000030h] 5_2_0365002D
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0365002D mov eax, dword ptr fs:[00000030h] 5_2_0365002D
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363B02A mov eax, dword ptr fs:[00000030h] 5_2_0363B02A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363B02A mov eax, dword ptr fs:[00000030h] 5_2_0363B02A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363B02A mov eax, dword ptr fs:[00000030h] 5_2_0363B02A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0363B02A mov eax, dword ptr fs:[00000030h] 5_2_0363B02A
Source: C:\Windows\SysWOW64\help.exe Code function: 5_2_0364A830 mov eax, dword ptr fs:[00000030h] 5_2_0364A830
Enables debug privileges
Source: C:\Users\user\Desktop\SX365783909782021.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process token adjusted: Debug Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.vacalinda.com
Source: C:\Windows\explorer.exe Domain query: www.servicesbackyard.com
Source: C:\Windows\explorer.exe Domain query: www.caravansforsalenorthwales.com
Source: C:\Windows\explorer.exe Network Connect: 142.250.180.243 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.djspencer.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 168.235.88.209 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 159.89.244.183 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\SX365783909782021.exe Section loaded: unknown target: C:\Users\user\Desktop\SX365783909782021.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SX365783909782021.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SX365783909782021.exe Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\SX365783909782021.exe Section loaded: unknown target: C:\Windows\SysWOW64\help.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\SX365783909782021.exe Thread register set: target process: 3388 Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Thread register set: target process: 3388 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\SX365783909782021.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\SX365783909782021.exe Section unmapped: C:\Windows\SysWOW64\help.exe base address: BB0000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\SX365783909782021.exe Process created: C:\Users\user\Desktop\SX365783909782021.exe 'C:\Users\user\Desktop\SX365783909782021.exe' Jump to behavior
Source: C:\Windows\SysWOW64\help.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\SX365783909782021.exe' Jump to behavior
Source: explorer.exe, 00000003.00000000.214211632.0000000001398000.00000004.00000020.sdmp Binary or memory string: ProgmanamF
Source: explorer.exe, 00000003.00000000.214392871.0000000001980000.00000002.00000001.sdmp, help.exe, 00000005.00000002.476078258.0000000004A90000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000003.00000000.214392871.0000000001980000.00000002.00000001.sdmp, help.exe, 00000005.00000002.476078258.0000000004A90000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.214392871.0000000001980000.00000002.00000001.sdmp, help.exe, 00000005.00000002.476078258.0000000004A90000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.214392871.0000000001980000.00000002.00000001.sdmp, help.exe, 00000005.00000002.476078258.0000000004A90000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: C:\Users\user\Desktop\SX365783909782021.exe Code function: 0_2_00405B88 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 0_2_00405B88

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.473754310.0000000003200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.209804420.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.258786803.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.211210535.00000000022B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.258837957.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.472090660.0000000000C30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.2.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SX365783909782021.exe.22b0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SX365783909782021.exe.22b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000002.00000002.258574044.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.473754310.0000000003200000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000001.209804420.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.258786803.00000000005B0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.211210535.00000000022B0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.258837957.0000000000710000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.472090660.0000000000C30000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 2.2.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.1.SX365783909782021.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SX365783909782021.exe.22b0000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.SX365783909782021.exe.22b0000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.SX365783909782021.exe.400000.0.raw.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 433214 Sample: SX365783909782021.bat Startdate: 11/06/2021 Architecture: WINDOWS Score: 100 36 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->36 38 Found malware configuration 2->38 40 Malicious sample detected (through community Yara rule) 2->40 42 5 other signatures 2->42 10 SX365783909782021.exe 20 2->10         started        process3 file4 28 C:\Users\user\AppData\Local\...\System.dll, PE32 10->28 dropped 52 Detected unpacking (changes PE section rights) 10->52 54 Maps a DLL or memory area into another process 10->54 56 Tries to detect virtualization through RDTSC time measurements 10->56 14 SX365783909782021.exe 10->14         started        signatures5 process6 signatures7 58 Modifies the context of a thread in another process (thread injection) 14->58 60 Maps a DLL or memory area into another process 14->60 62 Sample uses process hollowing technique 14->62 64 Queues an APC in another process (thread injection) 14->64 17 explorer.exe 14->17 injected process8 dnsIp9 30 www.djspencer.com 159.89.244.183, 49741, 80 DIGITALOCEAN-ASNUS United States 17->30 32 www.vacalinda.com 17->32 34 5 other IPs or domains 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 help.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.180.243
 ghs.googlehosted.com United States
15169 GOOGLEUS false
34.102.136.180
 caravansforsalenorthwales.com United States
15169 GOOGLEUS false
168.235.88.209
 parking.namesilo.com United States
3842 RAMNODEUS false
159.89.244.183
 www.djspencer.com United States
14061 DIGITALOCEAN-ASNUS true

Contacted Domains

Name IP Active
parking.namesilo.com 168.235.88.209 true
www.djspencer.com 159.89.244.183 true
ghs.googlehosted.com 142.250.180.243 true
caravansforsalenorthwales.com 34.102.136.180 true
www.vacalinda.com unknown unknown
www.servicesbackyard.com unknown unknown
www.caravansforsalenorthwales.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.djspencer.com/ngvm/?w6A=HBVp1ZFUGcT+hxfW3ntFEbmU5GO8vrkA1mLmG5vd048TCTgwy52mAcu3AE2RaU7PuRfb&3fox=SBZ4 true
  • Avira URL Cloud: safe
 unknown
http://www.caravansforsalenorthwales.com/ngvm/?w6A=uz7CW46zGnQqpjgqznnFmpPrWAklZoEybcG+oUJN9dvYL4OpOEr/HbmCuGHk2zZbqVpb&3fox=SBZ4 false
  • Avira URL Cloud: safe
 unknown
www.moneyhuntercom.info/ngvm/ true
  • Avira URL Cloud: safe
 low
http://www.vacalinda.com/ngvm/?w6A=st23zvU/E1xU5Qy7Hp2PD30UnMfCa5knANSLf3ItiB6oVvQd6+qg6yvUWRtcyiXbPLds&3fox=SBZ4 false
  • Avira URL Cloud: safe
 unknown
http://www.servicesbackyard.com/ngvm/?w6A=UyLqygKx2FmdGYSRh5mqmU7zHOPmyh0H52xSnc3cVgCKFPBqoRmOJ0eYguKTgHZNEA4k&3fox=SBZ4 true
  • Avira URL Cloud: safe
 unknown