Analysis Report XhU4EXUp0x.exe

Overview

General Information

Sample Name: XhU4EXUp0x.exe
Analysis ID: 433531
MD5: 49c83eceb8a816b959a778e5f2e78801
SHA1: ead9055c813de47edfec5bc46a0d896df4b4af2e
SHA256: 2f4d0e2ce90ab2c35dcba4c85e38346eae6ac2cef0f939ccdd21cade4d6343ca
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
System process connects to network (likely due to code injection or exploit)
Yara detected AntiVM3
Yara detected FormBook
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Maps a DLL or memory area into another process
Modifies the context of a thread in another process (thread injection)
Modifies the prolog of user mode functions (user mode inline hooks)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Queues an APC in another process (thread injection)
Sample uses process hollowing technique
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Tries to detect virtualization through RDTSC time measurements
Antivirus or Machine Learning detection for unpacked file
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Contains functionality for execution timing, often used to detect debuggers
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to read the PEB
Contains long sleeps (>= 3 min)
Creates a DirectInput object (often for capturing keystrokes)
Creates a process in suspended mode (likely to inject code)
Detected potential crypto function
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Found potential string decryption / allocating functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries the volume information (name, serial number etc) of a device
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.yellow-wink.com/nff/"], "decoy": ["shinseikai.site", "creditmystartup.com", "howtovvbucks.com", "betterfromthebeginning.com", "oubacm.com", "stonalogov.com", "gentrypartyof8.com", "cuesticksandsupplies.com", "joelsavestheday.com", "llanobnb.com", "ecclogic.com", "miempaque.com", "cai23668.com", "miscdr.net", "twzhhq.com", "bloomandbrewcafe.com", "angcomleisure.com", "mafeeboutique.com", "300coin.club", "brooksranchhomes.com", "konversiondigital.com", "dominivision.com", "superiorshinedetailing.net", "thehomechef.global", "dating-web.site", "gcbsclubc.com", "mothererph.com", "pacleanfuel.com", "jerseryshorenflflagfootball.com", "roberthyatt.com", "wwwmacsports.com", "tearor.com", "american-ai.com", "mkyiyuan.com", "gempharmatechllc.com", "verdijvtc.com", "zimnik-bibo.one", "heatherdarkauthor.net", "dunn-labs.com", "automotivevita.com", "bersatubagaidulu.com", "gorillarecruiting.com", "mikecdmusic.com", "femuveewedre.com", "onyxmodsllc.com", "ooweesports.com", "dezeren.com", "foeweifgoor73dz.com", "sorchaashe.com", "jamiitulivu.com", "jifengshijie.com", "ranchfiberglas.com", "glendalesocialmediaagency.com", "icuvietnam.com", "404hapgood.com", "planetturmeric.com", "danfrem.com", "amazonautomationbusiness.com", "switchfinder.com", "diversifiedforest.com", "findnehomes.com", "rsyueda.com", "colombianmatrimony.com", "evan-dawson.info"]}
Multi AV Scanner detection for submitted file
Source: XhU4EXUp0x.exe Virustotal: Detection: 21% Perma Link
Source: XhU4EXUp0x.exe ReversingLabs: Detection: 26%
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.652221131.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.911907238.0000000000A90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.912137473.0000000000E80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.912162573.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.655856649.00000000037F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.706990052.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654291332.00000000036B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.707426607.0000000001600000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.XhU4EXUp0x.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XhU4EXUp0x.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.XhU4EXUp0x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XhU4EXUp0x.exe.400000.1.unpack, type: UNPACKEDPE
Machine Learning detection for sample
Source: XhU4EXUp0x.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 3.2.XhU4EXUp0x.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.XhU4EXUp0x.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: XhU4EXUp0x.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: XhU4EXUp0x.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.669343721.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\YfQkSBryuS\src\obj\Debug\ProfileOptimization.pdb source: XhU4EXUp0x.exe
Source: Binary string: wntdll.pdbUGP source: XhU4EXUp0x.exe, 00000003.00000002.707641443.0000000001930000.00000040.00000001.sdmp, raserver.exe, 0000000C.00000002.912987032.0000000004BFF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: XhU4EXUp0x.exe, raserver.exe
Source: Binary string: RAServer.pdb source: XhU4EXUp0x.exe, 00000003.00000002.707590458.000000000169A000.00000004.00000020.sdmp
Source: Binary string: RAServer.pdbGCTL source: XhU4EXUp0x.exe, 00000003.00000002.707590458.000000000169A000.00000004.00000020.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.669343721.0000000005A00000.00000002.00000001.sdmp

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_0B4EB2F0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_0B4EBD68
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 4x nop then mov dword ptr [ebp-18h], 00000000h 0_2_0B4EB2E1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 4x nop then pop edi 3_2_0040E442
Source: C:\Windows\SysWOW64\raserver.exe Code function: 4x nop then pop edi 12_2_00A9E442

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.yellow-wink.com/nff/
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /nff/?2dWD=oo8PZR09GamqRkCLHSTg5AKJvm44C+19X1uEOPW4zTuWS3c9RrL+Vx+B8IkF2PxixF5c&7nSX=f2MHEhOHwH HTTP/1.1Host: www.gentrypartyof8.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nff/?2dWD=rcekcafpraO0sj/oaoDcLlLwOdzHntpmaKyMQqwrcrTR8fOv+tmqTlrKj/r2WTcjy7/L&7nSX=f2MHEhOHwH HTTP/1.1Host: www.rsyueda.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 66.235.200.146 66.235.200.146
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: CLOUDFLARENETUS CLOUDFLARENETUS
Source: Joe Sandbox View ASN Name: LEASEWEB-USA-SEA-10US LEASEWEB-USA-SEA-10US
Source: global traffic HTTP traffic detected: GET /nff/?2dWD=oo8PZR09GamqRkCLHSTg5AKJvm44C+19X1uEOPW4zTuWS3c9RrL+Vx+B8IkF2PxixF5c&7nSX=f2MHEhOHwH HTTP/1.1Host: www.gentrypartyof8.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /nff/?2dWD=rcekcafpraO0sj/oaoDcLlLwOdzHntpmaKyMQqwrcrTR8fOv+tmqTlrKj/r2WTcjy7/L&7nSX=f2MHEhOHwH HTTP/1.1Host: www.rsyueda.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: unknown DNS traffic detected: queries for: www.gentrypartyof8.com
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://fontfabrik.com
Source: XhU4EXUp0x.exe, 00000000.00000002.653505336.00000000026B1000.00000004.00000001.sdmp String found in binary or memory: http://schemas.xmlsoap.org/ws/2005/05/identity/claims/name
Source: explorer.exe, 00000005.00000000.660621066.0000000002B50000.00000002.00000001.sdmp String found in binary or memory: http://www.%s.comPA
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.apache.org/licenses/LICENSE-2.0
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.carterandcone.coml
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/?
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/cabarga.htmlN
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers/frere-user.html
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers8
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designers?
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fontbureau.com/designersG
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.fonts.com
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/bThe
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.founder.com.cn/cn/cThe
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/DPlease
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.galapagosdesign.com/staff/dennis.htm
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.goodfont.co.kr
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.jiyu-kobo.co.jp/
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sajatypeworks.com
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sakkal.com
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.sandoll.co.kr
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.tiro.com
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.typography.netD
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.urwpp.deDPlease
Source: explorer.exe, 00000005.00000000.681251721.000000000B976000.00000002.00000001.sdmp String found in binary or memory: http://www.zhongyicts.com.cn
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp String found in binary or memory: https://stackpath.bootstrapcdn.com/bootstrap/4.5.0/css/bootstrap.min.css

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: XhU4EXUp0x.exe, 00000000.00000002.653237651.00000000009F0000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.652221131.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.911907238.0000000000A90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.912137473.0000000000E80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.912162573.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.655856649.00000000037F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.706990052.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654291332.00000000036B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.707426607.0000000001600000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.XhU4EXUp0x.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XhU4EXUp0x.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.XhU4EXUp0x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XhU4EXUp0x.exe.400000.1.unpack, type: UNPACKEDPE

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.652221131.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.652221131.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.911907238.0000000000A90000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.911907238.0000000000A90000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.912137473.0000000000E80000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.912137473.0000000000E80000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000C.00000002.912162573.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000C.00000002.912162573.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.655856649.00000000037F7000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.655856649.00000000037F7000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.706990052.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.706990052.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.654291332.00000000036B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.654291332.00000000036B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.707426607.0000000001600000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.707426607.0000000001600000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.XhU4EXUp0x.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.XhU4EXUp0x.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.XhU4EXUp0x.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.XhU4EXUp0x.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.XhU4EXUp0x.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.XhU4EXUp0x.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.XhU4EXUp0x.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.XhU4EXUp0x.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Contains functionality to call native functions
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00419D50 NtCreateFile, 3_2_00419D50
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00419E00 NtReadFile, 3_2_00419E00
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00419E80 NtClose, 3_2_00419E80
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00419F30 NtAllocateVirtualMemory, 3_2_00419F30
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00419DA9 NtReadFile, 3_2_00419DA9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00419E7A NtClose, 3_2_00419E7A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00419F2D NtAllocateVirtualMemory, 3_2_00419F2D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019999A0 NtCreateSection,LdrInitializeThunk, 3_2_019999A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_01999910
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019998F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_019998F0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999840 NtDelayExecution,LdrInitializeThunk, 3_2_01999840
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_01999860
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_01999A00
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999A20 NtResumeThread,LdrInitializeThunk, 3_2_01999A20
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999A50 NtCreateFile,LdrInitializeThunk, 3_2_01999A50
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019995D0 NtClose,LdrInitializeThunk, 3_2_019995D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999540 NtReadFile,LdrInitializeThunk, 3_2_01999540
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999780 NtMapViewOfSection,LdrInitializeThunk, 3_2_01999780
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019997A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_019997A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999710 NtQueryInformationToken,LdrInitializeThunk, 3_2_01999710
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019996E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_019996E0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_01999660
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019999D0 NtCreateProcessEx, 3_2_019999D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999950 NtQueueApcThread, 3_2_01999950
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019998A0 NtWriteVirtualMemory, 3_2_019998A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999820 NtEnumerateKey, 3_2_01999820
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0199B040 NtSuspendThread, 3_2_0199B040
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0199A3B0 NtGetContextThread, 3_2_0199A3B0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999B00 NtSetValueKey, 3_2_01999B00
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999A80 NtOpenDirectoryObject, 3_2_01999A80
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999A10 NtQuerySection, 3_2_01999A10
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019995F0 NtQueryInformationFile, 3_2_019995F0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0199AD30 NtSetContextThread, 3_2_0199AD30
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999520 NtWaitForSingleObject, 3_2_01999520
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999560 NtWriteFile, 3_2_01999560
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999FE0 NtCreateMutant, 3_2_01999FE0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0199A710 NtOpenProcessToken, 3_2_0199A710
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999730 NtQueryVirtualMemory, 3_2_01999730
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0199A770 NtOpenThread, 3_2_0199A770
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999770 NtSetInformationFile, 3_2_01999770
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999760 NtOpenProcess, 3_2_01999760
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019996D0 NtCreateKey, 3_2_019996D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999610 NtEnumerateValueKey, 3_2_01999610
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999650 NtQueryValueKey, 3_2_01999650
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01999670 NtQueryInformationProcess, 3_2_01999670
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B495D0 NtClose,LdrInitializeThunk, 12_2_04B495D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49540 NtReadFile,LdrInitializeThunk, 12_2_04B49540
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B496E0 NtFreeVirtualMemory,LdrInitializeThunk, 12_2_04B496E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B496D0 NtCreateKey,LdrInitializeThunk, 12_2_04B496D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49660 NtAllocateVirtualMemory,LdrInitializeThunk, 12_2_04B49660
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49650 NtQueryValueKey,LdrInitializeThunk, 12_2_04B49650
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49780 NtMapViewOfSection,LdrInitializeThunk, 12_2_04B49780
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49FE0 NtCreateMutant,LdrInitializeThunk, 12_2_04B49FE0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49710 NtQueryInformationToken,LdrInitializeThunk, 12_2_04B49710
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49860 NtQuerySystemInformation,LdrInitializeThunk, 12_2_04B49860
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49840 NtDelayExecution,LdrInitializeThunk, 12_2_04B49840
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B499A0 NtCreateSection,LdrInitializeThunk, 12_2_04B499A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49910 NtAdjustPrivilegesToken,LdrInitializeThunk, 12_2_04B49910
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49A50 NtCreateFile,LdrInitializeThunk, 12_2_04B49A50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B495F0 NtQueryInformationFile, 12_2_04B495F0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B4AD30 NtSetContextThread, 12_2_04B4AD30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49520 NtWaitForSingleObject, 12_2_04B49520
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49560 NtWriteFile, 12_2_04B49560
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49610 NtEnumerateValueKey, 12_2_04B49610
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49670 NtQueryInformationProcess, 12_2_04B49670
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B497A0 NtUnmapViewOfSection, 12_2_04B497A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49730 NtQueryVirtualMemory, 12_2_04B49730
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B4A710 NtOpenProcessToken, 12_2_04B4A710
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B4A770 NtOpenThread, 12_2_04B4A770
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49770 NtSetInformationFile, 12_2_04B49770
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49760 NtOpenProcess, 12_2_04B49760
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B498A0 NtWriteVirtualMemory, 12_2_04B498A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B498F0 NtReadVirtualMemory, 12_2_04B498F0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49820 NtEnumerateKey, 12_2_04B49820
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B4B040 NtSuspendThread, 12_2_04B4B040
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B499D0 NtCreateProcessEx, 12_2_04B499D0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49950 NtQueueApcThread, 12_2_04B49950
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49A80 NtOpenDirectoryObject, 12_2_04B49A80
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49A20 NtResumeThread, 12_2_04B49A20
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49A10 NtQuerySection, 12_2_04B49A10
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49A00 NtProtectVirtualMemory, 12_2_04B49A00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B4A3B0 NtGetContextThread, 12_2_04B4A3B0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B49B00 NtSetValueKey, 12_2_04B49B00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA9D50 NtCreateFile, 12_2_00AA9D50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA9E80 NtClose, 12_2_00AA9E80
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA9E00 NtReadFile, 12_2_00AA9E00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA9F30 NtAllocateVirtualMemory, 12_2_00AA9F30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA9DA9 NtReadFile, 12_2_00AA9DA9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA9E7A NtClose, 12_2_00AA9E7A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA9F2D NtAllocateVirtualMemory, 12_2_00AA9F2D
Detected potential crypto function
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B5FB20 0_2_00B5FB20
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B5C2B0 0_2_00B5C2B0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B594B0 0_2_00B594B0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B5F73D 0_2_00B5F73D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E4E58 0_2_0B4E4E58
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E8E6A 0_2_0B4E8E6A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4EBD68 0_2_0B4EBD68
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E6578 0_2_0B4E6578
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4EA52C 0_2_0B4EA52C
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E4588 0_2_0B4E4588
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E4240 0_2_0B4E4240
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E8890 0_2_0B4E8890
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E88A0 0_2_0B4E88A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E8E5E 0_2_0B4E8E5E
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E8EEC 0_2_0B4E8EEC
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E8C8C 0_2_0B4E8C8C
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E8C98 0_2_0B4E8C98
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041D069 3_2_0041D069
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041DA97 3_2_0041DA97
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041D5C9 3_2_0041D5C9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00402D8D 3_2_00402D8D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00409E2B 3_2_00409E2B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00409E30 3_2_00409E30
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041DF79 3_2_0041DF79
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195F900 3_2_0195F900
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01974120 3_2_01974120
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196B090 3_2_0196B090
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A220A8 3_2_01A220A8
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019820A0 3_2_019820A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A228EC 3_2_01A228EC
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A2E824 3_2_01A2E824
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11002 3_2_01A11002
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A830 3_2_0197A830
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198EBB0 3_2_0198EBB0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198ABD8 3_2_0198ABD8
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1DBD2 3_2_01A1DBD2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A103DA 3_2_01A103DA
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A22B28 3_2_01A22B28
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197AB40 3_2_0197AB40
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A222AE 3_2_01A222AE
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A0FA2B 3_2_01A0FA2B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982581 3_2_01982581
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196D5E0 3_2_0196D5E0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A225DD 3_2_01A225DD
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A22D07 3_2_01A22D07
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01950D20 3_2_01950D20
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A21D55 3_2_01A21D55
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196841F 3_2_0196841F
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1D466 3_2_01A1D466
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A21FF1 3_2_01A21FF1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A2DFCE 3_2_01A2DFCE
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A22EF7 3_2_01A22EF7
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01976E30 3_2_01976E30
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1D616 3_2_01A1D616
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B1841F 12_2_04B1841F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCD466 12_2_04BCD466
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B32581 12_2_04B32581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC2D82 12_2_04BC2D82
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B1D5E0 12_2_04B1D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD25DD 12_2_04BD25DD
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B00D20 12_2_04B00D20
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD2D07 12_2_04BD2D07
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD1D55 12_2_04BD1D55
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD2EF7 12_2_04BD2EF7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B26E30 12_2_04B26E30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCD616 12_2_04BCD616
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD1FF1 12_2_04BD1FF1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BDDFCE 12_2_04BDDFCE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B320A0 12_2_04B320A0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD20A8 12_2_04BD20A8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B1B090 12_2_04B1B090
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD28EC 12_2_04BD28EC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2A830 12_2_04B2A830
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BDE824 12_2_04BDE824
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1002 12_2_04BC1002
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B299BF 12_2_04B299BF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B24120 12_2_04B24120
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B0F900 12_2_04B0F900
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD22AE 12_2_04BD22AE
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4AEF 12_2_04BC4AEF
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BBFA2B 12_2_04BBFA2B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3EBB0 12_2_04B3EBB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BB23E3 12_2_04BB23E3
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC03DA 12_2_04BC03DA
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3ABD8 12_2_04B3ABD8
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCDBD2 12_2_04BCDBD2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD2B28 12_2_04BD2B28
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2A309 12_2_04B2A309
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2AB40 12_2_04B2AB40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AAD069 12_2_00AAD069
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AADA97 12_2_00AADA97
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00A92D8D 12_2_00A92D8D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00A92D90 12_2_00A92D90
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00A99E2B 12_2_00A99E2B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00A99E30 12_2_00A99E30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00A92FB0 12_2_00A92FB0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AADF79 12_2_00AADF79
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: String function: 0195B150 appears 87 times
Source: C:\Windows\SysWOW64\raserver.exe Code function: String function: 04B0B150 appears 133 times
Sample file is different than original file name gathered from version info
Source: XhU4EXUp0x.exe, 00000000.00000002.657834635.0000000005920000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameDSASignature.dll@ vs XhU4EXUp0x.exe
Source: XhU4EXUp0x.exe, 00000000.00000000.643332701.0000000000420000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameProfileOptimization.exe8 vs XhU4EXUp0x.exe
Source: XhU4EXUp0x.exe, 00000000.00000002.653237651.00000000009F0000.00000004.00000020.sdmp Binary or memory string: OriginalFilenameclr.dllT vs XhU4EXUp0x.exe
Source: XhU4EXUp0x.exe, 00000003.00000002.707120497.0000000000F40000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameProfileOptimization.exe8 vs XhU4EXUp0x.exe
Source: XhU4EXUp0x.exe, 00000003.00000002.707570278.0000000001689000.00000040.00000001.sdmp Binary or memory string: OriginalFilenameraserver.exej% vs XhU4EXUp0x.exe
Source: XhU4EXUp0x.exe, 00000003.00000002.708280098.0000000001BDF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs XhU4EXUp0x.exe
Source: XhU4EXUp0x.exe Binary or memory string: OriginalFilenameProfileOptimization.exe8 vs XhU4EXUp0x.exe
Uses 32bit PE files
Source: XhU4EXUp0x.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.652221131.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.652221131.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.911907238.0000000000A90000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.911907238.0000000000A90000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.912137473.0000000000E80000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.912137473.0000000000E80000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000C.00000002.912162573.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000C.00000002.912162573.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.655856649.00000000037F7000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.655856649.00000000037F7000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.706990052.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.706990052.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.654291332.00000000036B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.654291332.00000000036B9000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.707426607.0000000001600000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.707426607.0000000001600000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.XhU4EXUp0x.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.XhU4EXUp0x.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.XhU4EXUp0x.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.XhU4EXUp0x.exe.400000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.XhU4EXUp0x.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.XhU4EXUp0x.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.XhU4EXUp0x.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.XhU4EXUp0x.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: XhU4EXUp0x.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/1@2/2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\XhU4EXUp0x.exe.log Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Mutant created: \Sessions\1\BaseNamedObjects\zheXInonhS
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2216:120:WilError_01
Source: XhU4EXUp0x.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: Select * from Clientes WHERE id=@id;;
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: Select * from Aluguel Erro ao listar Banco sql-Aluguel.INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE id=@id;
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType WHERE modelo=@modelo;
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Itens_Aluguel VALUES(@aluguelID, @aviaoID, @validade);
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: Insert into Clientes values (@nome, @cpf, @rg, @cidade, @endereco, @uf, @telefone);
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: INSERT INTO Aluguel VALUES(@clienteID, @data);
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: INSERT INTO SecurityLogonType VALUES(@modelo, @fabricante, @ano, @cor);
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: Select * from SecurityLogonType*Erro ao listar Banco sql-SecurityLogonType,Select * from SecurityLogonType WHERE id=@id;Select * from SecurityLogonType WHERE (modelo LIKE @modelo)
Source: XhU4EXUp0x.exe Virustotal: Detection: 21%
Source: XhU4EXUp0x.exe ReversingLabs: Detection: 26%
Source: unknown Process created: C:\Users\user\Desktop\XhU4EXUp0x.exe 'C:\Users\user\Desktop\XhU4EXUp0x.exe'
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process created: C:\Users\user\Desktop\XhU4EXUp0x.exe C:\Users\user\Desktop\XhU4EXUp0x.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\raserver.exe C:\Windows\SysWOW64\raserver.exe
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\XhU4EXUp0x.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process created: C:\Users\user\Desktop\XhU4EXUp0x.exe C:\Users\user\Desktop\XhU4EXUp0x.exe Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\XhU4EXUp0x.exe' Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{CF4CC405-E2C5-4DDD-B3CE-5E7582D8C9FA}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: XhU4EXUp0x.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: XhU4EXUp0x.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: XhU4EXUp0x.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: wscui.pdbUGP source: explorer.exe, 00000005.00000000.669343721.0000000005A00000.00000002.00000001.sdmp
Source: Binary string: C:\Users\Administrator\Desktop\Client\Temp\YfQkSBryuS\src\obj\Debug\ProfileOptimization.pdb source: XhU4EXUp0x.exe
Source: Binary string: wntdll.pdbUGP source: XhU4EXUp0x.exe, 00000003.00000002.707641443.0000000001930000.00000040.00000001.sdmp, raserver.exe, 0000000C.00000002.912987032.0000000004BFF000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: XhU4EXUp0x.exe, raserver.exe
Source: Binary string: RAServer.pdb source: XhU4EXUp0x.exe, 00000003.00000002.707590458.000000000169A000.00000004.00000020.sdmp
Source: Binary string: RAServer.pdbGCTL source: XhU4EXUp0x.exe, 00000003.00000002.707590458.000000000169A000.00000004.00000020.sdmp
Source: Binary string: wscui.pdb source: explorer.exe, 00000005.00000000.669343721.0000000005A00000.00000002.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B5AC80 pushfd ; retn 0004h 0_2_00B5AC82
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B5ACD1 pushfd ; retn 0004h 0_2_00B5ACD2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B5AC31 pushfd ; retn 0004h 0_2_00B5AC32
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B5B1C0 pushfd ; retn 0004h 0_2_00B5B1D2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_00B53768 push eax; retn 0004h 0_2_00B53769
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 0_2_0B4E944C push esp; iretd 0_2_0B4E944E
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041D069 push esi; ret 3_2_0041D067
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_004080F7 pushad ; retf 3_2_004080FC
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_004169CD push ecx; iretd 3_2_004169D4
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_004169F6 push eax; iretd 3_2_004169F7
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041DA38 push esi; ret 3_2_0041D067
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0040E2FF push ds; retf 3_2_0040E326
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041DA97 push esi; ret 3_2_0041D067
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00417ABB push ebx; iretd 3_2_00417ABC
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041833A push cs; retf 3_2_0041833D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_004164C5 push es; retf 3_2_004164CA
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041D4FB push esi; ret 3_2_0041D067
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041D5C9 push esi; ret 3_2_0041D067
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041CEF2 push eax; ret 3_2_0041CEF8
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041CEFB push eax; ret 3_2_0041CF62
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041CEA5 push eax; ret 3_2_0041CEF8
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041CF5C push eax; ret 3_2_0041CF62
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041D7F1 push esi; ret 3_2_0041D067
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041CF89 push esi; ret 3_2_0041D067
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0041CF96 push esi; ret 3_2_0041D067
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019AD0D1 push ecx; ret 3_2_019AD0E4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B5D0D1 push ecx; ret 12_2_04B5D0E4
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00A980F7 pushad ; retf 12_2_00A980FC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AAD069 push esi; ret 12_2_00AAD067
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA69F6 push eax; iretd 12_2_00AA69F7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_00AA69CD push ecx; iretd 12_2_00AA69D4
Source: initial sample Static PE information: section name: .text entropy: 7.68116376135

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x85 0x5E 0xE9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: XhU4EXUp0x.exe PID: 6968, type: MEMORY
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe WMI Queries: IWbemServices::ExecQuery - ROOT\cimv2 : SELECT * FROM Win32_VideoController
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: XhU4EXUp0x.exe, 00000000.00000002.653505336.00000000026B1000.00000004.00000001.sdmp Binary or memory string: WINE_GET_UNIX_FILE_NAME
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe RDTSC instruction interceptor: First address: 00000000004098E4 second address: 00000000004098EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe RDTSC instruction interceptor: First address: 0000000000409B4E second address: 0000000000409B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000000A998E4 second address: 0000000000A998EA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\raserver.exe RDTSC instruction interceptor: First address: 0000000000A99B4E second address: 0000000000A99B54 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains capabilities to detect virtual machines
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DEVICEMAP\Scsi\Scsi Port 0\Scsi Bus 0\Target Id 0\Logical Unit Id 0 name: Identifier Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: SystemBiosVersion Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4d36e968-e325-11ce-bfc1-08002be10318}\0000 name: DriverDesc Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Registry key queried: HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum name: 0 Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Registry key queried: HKEY_LOCAL_MACHINE\HARDWARE\DESCRIPTION\System name: VideoBiosVersion Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00409A80 rdtsc 3_2_00409A80
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Thread delayed: delay time: 922337203685477 Jump to behavior
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe TID: 6972 Thread sleep time: -104441s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe TID: 7020 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe TID: 2016 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 3220 Thread sleep time: -60000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe TID: 6964 Thread sleep time: -65000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Thread delayed: delay time: 104441 Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: explorer.exe, 00000005.00000000.680569789.000000000A868000.00000004.00000001.sdmp Binary or memory string: SI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI`=
Source: XhU4EXUp0x.exe, 00000000.00000002.653357371.0000000000A9F000.00000004.00000020.sdmp Binary or memory string: VMware
Source: explorer.exe, 00000005.00000000.669123730.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A Virtual Machine could not be started because Hyper-V is not installed.
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.676990753.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.677547132.000000000A716000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATAa
Source: XhU4EXUp0x.exe, 00000000.00000002.653505336.00000000026B1000.00000004.00000001.sdmp Binary or memory string: VMWARE
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: InstallPath%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.677547132.000000000A716000.00000004.00000001.sdmp Binary or memory string: ?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&d
Source: explorer.exe, 00000005.00000000.697429263.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.677547132.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: XhU4EXUp0x.exe, 00000000.00000002.653357371.0000000000A9F000.00000004.00000020.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMwareCWYACNw
Source: explorer.exe, 00000005.00000000.669123730.00000000058C0000.00000002.00000001.sdmp Binary or memory string: The communication protocol version between the Hyper-V Host and Guest Compute Services is not supported.
Source: XhU4EXUp0x.exe, 00000000.00000002.653505336.00000000026B1000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: VMWARE"SOFTWARE\VMware, Inc.\VMware ToolsLHARDWARE\DEVICEMAP\Scsi\Scsi Port 1\Scsi Bus 0\Target Id 0\Logical Unit Id 0LHARDWARE\DEVICEMAP\Scsi\Scsi Port 2\Scsi Bus 0\Target Id 0\Logical Unit Id 0'SYSTEM\ControlSet001\Services\Disk\Enum
Source: explorer.exe, 00000005.00000000.677896891.000000000A784000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: vmwareNSYSTEM\ControlSet001\Control\Class\{4D36E968-E325-11CE-BFC1-08002BE10318}\0000
Source: XhU4EXUp0x.exe, 00000000.00000002.653357371.0000000000A9F000.00000004.00000020.sdmp Binary or memory string: Win32_VideoController(Standard display types)VMwareCWYACNDAWin32_VideoController92RGKB5VVideoController120060621000000.000000-00068978660display.infMSBDACRVZ4Z54PCI\VEN_15AD&DEV_0405&SUBSYS_040515AD&REV_00\3&61AAA01&0&78OKWin32_ComputerSystemcomputer1280 x 1024 x 4294967296 colorsAXM45XBV>K
Source: explorer.exe, 00000005.00000000.676990753.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: XhU4EXUp0x.exe, 00000000.00000002.653505336.00000000026B1000.00000004.00000001.sdmp Binary or memory string: vmware
Source: XhU4EXUp0x.exe, 00000000.00000002.653505336.00000000026B1000.00000004.00000001.sdmp Binary or memory string: l%C:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000005.00000000.669704877.0000000006650000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: XhU4EXUp0x.exe, 00000000.00000002.653535453.00000000026EF000.00000004.00000001.sdmp Binary or memory string: VMware SVGA II!Add-MpPreference -ExclusionPath "
Source: explorer.exe, 00000005.00000000.669123730.00000000058C0000.00000002.00000001.sdmp Binary or memory string: A communication protocol error has occurred between the Hyper-V Host and Guest Compute Service.
Source: XhU4EXUp0x.exe, 00000000.00000002.653505336.00000000026B1000.00000004.00000001.sdmp Binary or memory string: l"SOFTWARE\VMware, Inc.\VMware Tools
Source: explorer.exe, 00000005.00000000.669123730.00000000058C0000.00000002.00000001.sdmp Binary or memory string: An unknown internal message was received by the Hyper-V Compute Service.
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process information queried: ProcessInformation Jump to behavior

Anti Debugging:

barindex
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_00409A80 rdtsc 3_2_00409A80
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0040ACC0 LdrLoadDll, 3_2_0040ACC0
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A149A4 mov eax, dword ptr fs:[00000030h] 3_2_01A149A4
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A149A4 mov eax, dword ptr fs:[00000030h] 3_2_01A149A4
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A149A4 mov eax, dword ptr fs:[00000030h] 3_2_01A149A4
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A149A4 mov eax, dword ptr fs:[00000030h] 3_2_01A149A4
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982990 mov eax, dword ptr fs:[00000030h] 3_2_01982990
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197C182 mov eax, dword ptr fs:[00000030h] 3_2_0197C182
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198A185 mov eax, dword ptr fs:[00000030h] 3_2_0198A185
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D51BE mov eax, dword ptr fs:[00000030h] 3_2_019D51BE
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D51BE mov eax, dword ptr fs:[00000030h] 3_2_019D51BE
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D51BE mov eax, dword ptr fs:[00000030h] 3_2_019D51BE
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D51BE mov eax, dword ptr fs:[00000030h] 3_2_019D51BE
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov ecx, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov ecx, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov eax, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov ecx, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov ecx, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov eax, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov ecx, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov ecx, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov eax, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov ecx, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov ecx, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019799BF mov eax, dword ptr fs:[00000030h] 3_2_019799BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019861A0 mov eax, dword ptr fs:[00000030h] 3_2_019861A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019861A0 mov eax, dword ptr fs:[00000030h] 3_2_019861A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D69A6 mov eax, dword ptr fs:[00000030h] 3_2_019D69A6
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0195B1E1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0195B1E1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195B1E1 mov eax, dword ptr fs:[00000030h] 3_2_0195B1E1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019E41E8 mov eax, dword ptr fs:[00000030h] 3_2_019E41E8
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01959100 mov eax, dword ptr fs:[00000030h] 3_2_01959100
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01959100 mov eax, dword ptr fs:[00000030h] 3_2_01959100
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01959100 mov eax, dword ptr fs:[00000030h] 3_2_01959100
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198513A mov eax, dword ptr fs:[00000030h] 3_2_0198513A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198513A mov eax, dword ptr fs:[00000030h] 3_2_0198513A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01974120 mov eax, dword ptr fs:[00000030h] 3_2_01974120
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01974120 mov eax, dword ptr fs:[00000030h] 3_2_01974120
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01974120 mov eax, dword ptr fs:[00000030h] 3_2_01974120
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01974120 mov eax, dword ptr fs:[00000030h] 3_2_01974120
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01974120 mov ecx, dword ptr fs:[00000030h] 3_2_01974120
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197B944 mov eax, dword ptr fs:[00000030h] 3_2_0197B944
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197B944 mov eax, dword ptr fs:[00000030h] 3_2_0197B944
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195B171 mov eax, dword ptr fs:[00000030h] 3_2_0195B171
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195B171 mov eax, dword ptr fs:[00000030h] 3_2_0195B171
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195C962 mov eax, dword ptr fs:[00000030h] 3_2_0195C962
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01959080 mov eax, dword ptr fs:[00000030h] 3_2_01959080
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D3884 mov eax, dword ptr fs:[00000030h] 3_2_019D3884
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D3884 mov eax, dword ptr fs:[00000030h] 3_2_019D3884
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198F0BF mov ecx, dword ptr fs:[00000030h] 3_2_0198F0BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198F0BF mov eax, dword ptr fs:[00000030h] 3_2_0198F0BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198F0BF mov eax, dword ptr fs:[00000030h] 3_2_0198F0BF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019990AF mov eax, dword ptr fs:[00000030h] 3_2_019990AF
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019820A0 mov eax, dword ptr fs:[00000030h] 3_2_019820A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019820A0 mov eax, dword ptr fs:[00000030h] 3_2_019820A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019820A0 mov eax, dword ptr fs:[00000030h] 3_2_019820A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019820A0 mov eax, dword ptr fs:[00000030h] 3_2_019820A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019820A0 mov eax, dword ptr fs:[00000030h] 3_2_019820A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019820A0 mov eax, dword ptr fs:[00000030h] 3_2_019820A0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EB8D0 mov eax, dword ptr fs:[00000030h] 3_2_019EB8D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EB8D0 mov ecx, dword ptr fs:[00000030h] 3_2_019EB8D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EB8D0 mov eax, dword ptr fs:[00000030h] 3_2_019EB8D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EB8D0 mov eax, dword ptr fs:[00000030h] 3_2_019EB8D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EB8D0 mov eax, dword ptr fs:[00000030h] 3_2_019EB8D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EB8D0 mov eax, dword ptr fs:[00000030h] 3_2_019EB8D0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197B8E4 mov eax, dword ptr fs:[00000030h] 3_2_0197B8E4
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197B8E4 mov eax, dword ptr fs:[00000030h] 3_2_0197B8E4
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019540E1 mov eax, dword ptr fs:[00000030h] 3_2_019540E1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019540E1 mov eax, dword ptr fs:[00000030h] 3_2_019540E1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019540E1 mov eax, dword ptr fs:[00000030h] 3_2_019540E1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019558EC mov eax, dword ptr fs:[00000030h] 3_2_019558EC
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D7016 mov eax, dword ptr fs:[00000030h] 3_2_019D7016
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D7016 mov eax, dword ptr fs:[00000030h] 3_2_019D7016
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D7016 mov eax, dword ptr fs:[00000030h] 3_2_019D7016
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A830 mov eax, dword ptr fs:[00000030h] 3_2_0197A830
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A830 mov eax, dword ptr fs:[00000030h] 3_2_0197A830
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A830 mov eax, dword ptr fs:[00000030h] 3_2_0197A830
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A830 mov eax, dword ptr fs:[00000030h] 3_2_0197A830
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198002D mov eax, dword ptr fs:[00000030h] 3_2_0198002D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198002D mov eax, dword ptr fs:[00000030h] 3_2_0198002D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198002D mov eax, dword ptr fs:[00000030h] 3_2_0198002D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198002D mov eax, dword ptr fs:[00000030h] 3_2_0198002D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198002D mov eax, dword ptr fs:[00000030h] 3_2_0198002D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A24015 mov eax, dword ptr fs:[00000030h] 3_2_01A24015
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A24015 mov eax, dword ptr fs:[00000030h] 3_2_01A24015
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196B02A mov eax, dword ptr fs:[00000030h] 3_2_0196B02A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196B02A mov eax, dword ptr fs:[00000030h] 3_2_0196B02A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196B02A mov eax, dword ptr fs:[00000030h] 3_2_0196B02A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196B02A mov eax, dword ptr fs:[00000030h] 3_2_0196B02A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01970050 mov eax, dword ptr fs:[00000030h] 3_2_01970050
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01970050 mov eax, dword ptr fs:[00000030h] 3_2_01970050
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A12073 mov eax, dword ptr fs:[00000030h] 3_2_01A12073
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A21074 mov eax, dword ptr fs:[00000030h] 3_2_01A21074
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A25BA5 mov eax, dword ptr fs:[00000030h] 3_2_01A25BA5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198B390 mov eax, dword ptr fs:[00000030h] 3_2_0198B390
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982397 mov eax, dword ptr fs:[00000030h] 3_2_01982397
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01961B8F mov eax, dword ptr fs:[00000030h] 3_2_01961B8F
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01961B8F mov eax, dword ptr fs:[00000030h] 3_2_01961B8F
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A0D380 mov ecx, dword ptr fs:[00000030h] 3_2_01A0D380
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1138A mov eax, dword ptr fs:[00000030h] 3_2_01A1138A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01984BAD mov eax, dword ptr fs:[00000030h] 3_2_01984BAD
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01984BAD mov eax, dword ptr fs:[00000030h] 3_2_01984BAD
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01984BAD mov eax, dword ptr fs:[00000030h] 3_2_01984BAD
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D53CA mov eax, dword ptr fs:[00000030h] 3_2_019D53CA
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D53CA mov eax, dword ptr fs:[00000030h] 3_2_019D53CA
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019803E2 mov eax, dword ptr fs:[00000030h] 3_2_019803E2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019803E2 mov eax, dword ptr fs:[00000030h] 3_2_019803E2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019803E2 mov eax, dword ptr fs:[00000030h] 3_2_019803E2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019803E2 mov eax, dword ptr fs:[00000030h] 3_2_019803E2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019803E2 mov eax, dword ptr fs:[00000030h] 3_2_019803E2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019803E2 mov eax, dword ptr fs:[00000030h] 3_2_019803E2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197DBE9 mov eax, dword ptr fs:[00000030h] 3_2_0197DBE9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A309 mov eax, dword ptr fs:[00000030h] 3_2_0197A309
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1131B mov eax, dword ptr fs:[00000030h] 3_2_01A1131B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195F358 mov eax, dword ptr fs:[00000030h] 3_2_0195F358
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195DB40 mov eax, dword ptr fs:[00000030h] 3_2_0195DB40
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01983B7A mov eax, dword ptr fs:[00000030h] 3_2_01983B7A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01983B7A mov eax, dword ptr fs:[00000030h] 3_2_01983B7A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195DB60 mov ecx, dword ptr fs:[00000030h] 3_2_0195DB60
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A28B58 mov eax, dword ptr fs:[00000030h] 3_2_01A28B58
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198D294 mov eax, dword ptr fs:[00000030h] 3_2_0198D294
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198D294 mov eax, dword ptr fs:[00000030h] 3_2_0198D294
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196AAB0 mov eax, dword ptr fs:[00000030h] 3_2_0196AAB0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196AAB0 mov eax, dword ptr fs:[00000030h] 3_2_0196AAB0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198FAB0 mov eax, dword ptr fs:[00000030h] 3_2_0198FAB0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019552A5 mov eax, dword ptr fs:[00000030h] 3_2_019552A5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019552A5 mov eax, dword ptr fs:[00000030h] 3_2_019552A5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019552A5 mov eax, dword ptr fs:[00000030h] 3_2_019552A5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019552A5 mov eax, dword ptr fs:[00000030h] 3_2_019552A5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019552A5 mov eax, dword ptr fs:[00000030h] 3_2_019552A5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982ACB mov eax, dword ptr fs:[00000030h] 3_2_01982ACB
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982AE4 mov eax, dword ptr fs:[00000030h] 3_2_01982AE4
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195AA16 mov eax, dword ptr fs:[00000030h] 3_2_0195AA16
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195AA16 mov eax, dword ptr fs:[00000030h] 3_2_0195AA16
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01955210 mov eax, dword ptr fs:[00000030h] 3_2_01955210
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01955210 mov ecx, dword ptr fs:[00000030h] 3_2_01955210
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01955210 mov eax, dword ptr fs:[00000030h] 3_2_01955210
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01955210 mov eax, dword ptr fs:[00000030h] 3_2_01955210
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01973A1C mov eax, dword ptr fs:[00000030h] 3_2_01973A1C
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01968A0A mov eax, dword ptr fs:[00000030h] 3_2_01968A0A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01994A2C mov eax, dword ptr fs:[00000030h] 3_2_01994A2C
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01994A2C mov eax, dword ptr fs:[00000030h] 3_2_01994A2C
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1AA16 mov eax, dword ptr fs:[00000030h] 3_2_01A1AA16
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1AA16 mov eax, dword ptr fs:[00000030h] 3_2_01A1AA16
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197A229 mov eax, dword ptr fs:[00000030h] 3_2_0197A229
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A0B260 mov eax, dword ptr fs:[00000030h] 3_2_01A0B260
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A0B260 mov eax, dword ptr fs:[00000030h] 3_2_01A0B260
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A28A62 mov eax, dword ptr fs:[00000030h] 3_2_01A28A62
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019E4257 mov eax, dword ptr fs:[00000030h] 3_2_019E4257
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01959240 mov eax, dword ptr fs:[00000030h] 3_2_01959240
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01959240 mov eax, dword ptr fs:[00000030h] 3_2_01959240
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01959240 mov eax, dword ptr fs:[00000030h] 3_2_01959240
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01959240 mov eax, dword ptr fs:[00000030h] 3_2_01959240
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0199927A mov eax, dword ptr fs:[00000030h] 3_2_0199927A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1EA55 mov eax, dword ptr fs:[00000030h] 3_2_01A1EA55
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198FD9B mov eax, dword ptr fs:[00000030h] 3_2_0198FD9B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198FD9B mov eax, dword ptr fs:[00000030h] 3_2_0198FD9B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A205AC mov eax, dword ptr fs:[00000030h] 3_2_01A205AC
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A205AC mov eax, dword ptr fs:[00000030h] 3_2_01A205AC
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982581 mov eax, dword ptr fs:[00000030h] 3_2_01982581
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982581 mov eax, dword ptr fs:[00000030h] 3_2_01982581
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982581 mov eax, dword ptr fs:[00000030h] 3_2_01982581
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01982581 mov eax, dword ptr fs:[00000030h] 3_2_01982581
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01952D8A mov eax, dword ptr fs:[00000030h] 3_2_01952D8A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01952D8A mov eax, dword ptr fs:[00000030h] 3_2_01952D8A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01952D8A mov eax, dword ptr fs:[00000030h] 3_2_01952D8A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01952D8A mov eax, dword ptr fs:[00000030h] 3_2_01952D8A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01952D8A mov eax, dword ptr fs:[00000030h] 3_2_01952D8A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01981DB5 mov eax, dword ptr fs:[00000030h] 3_2_01981DB5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01981DB5 mov eax, dword ptr fs:[00000030h] 3_2_01981DB5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01981DB5 mov eax, dword ptr fs:[00000030h] 3_2_01981DB5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019835A1 mov eax, dword ptr fs:[00000030h] 3_2_019835A1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1FDE2 mov eax, dword ptr fs:[00000030h] 3_2_01A1FDE2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1FDE2 mov eax, dword ptr fs:[00000030h] 3_2_01A1FDE2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1FDE2 mov eax, dword ptr fs:[00000030h] 3_2_01A1FDE2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1FDE2 mov eax, dword ptr fs:[00000030h] 3_2_01A1FDE2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A08DF1 mov eax, dword ptr fs:[00000030h] 3_2_01A08DF1
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6DC9 mov eax, dword ptr fs:[00000030h] 3_2_019D6DC9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6DC9 mov eax, dword ptr fs:[00000030h] 3_2_019D6DC9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6DC9 mov eax, dword ptr fs:[00000030h] 3_2_019D6DC9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6DC9 mov ecx, dword ptr fs:[00000030h] 3_2_019D6DC9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6DC9 mov eax, dword ptr fs:[00000030h] 3_2_019D6DC9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6DC9 mov eax, dword ptr fs:[00000030h] 3_2_019D6DC9
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196D5E0 mov eax, dword ptr fs:[00000030h] 3_2_0196D5E0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196D5E0 mov eax, dword ptr fs:[00000030h] 3_2_0196D5E0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A28D34 mov eax, dword ptr fs:[00000030h] 3_2_01A28D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1E539 mov eax, dword ptr fs:[00000030h] 3_2_01A1E539
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01963D34 mov eax, dword ptr fs:[00000030h] 3_2_01963D34
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01984D3B mov eax, dword ptr fs:[00000030h] 3_2_01984D3B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01984D3B mov eax, dword ptr fs:[00000030h] 3_2_01984D3B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01984D3B mov eax, dword ptr fs:[00000030h] 3_2_01984D3B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195AD30 mov eax, dword ptr fs:[00000030h] 3_2_0195AD30
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019DA537 mov eax, dword ptr fs:[00000030h] 3_2_019DA537
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01977D50 mov eax, dword ptr fs:[00000030h] 3_2_01977D50
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01993D43 mov eax, dword ptr fs:[00000030h] 3_2_01993D43
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D3540 mov eax, dword ptr fs:[00000030h] 3_2_019D3540
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197C577 mov eax, dword ptr fs:[00000030h] 3_2_0197C577
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197C577 mov eax, dword ptr fs:[00000030h] 3_2_0197C577
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A03D40 mov eax, dword ptr fs:[00000030h] 3_2_01A03D40
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196849B mov eax, dword ptr fs:[00000030h] 3_2_0196849B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A114FB mov eax, dword ptr fs:[00000030h] 3_2_01A114FB
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6CF0 mov eax, dword ptr fs:[00000030h] 3_2_019D6CF0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6CF0 mov eax, dword ptr fs:[00000030h] 3_2_019D6CF0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6CF0 mov eax, dword ptr fs:[00000030h] 3_2_019D6CF0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A28CD6 mov eax, dword ptr fs:[00000030h] 3_2_01A28CD6
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6C0A mov eax, dword ptr fs:[00000030h] 3_2_019D6C0A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6C0A mov eax, dword ptr fs:[00000030h] 3_2_019D6C0A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6C0A mov eax, dword ptr fs:[00000030h] 3_2_019D6C0A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D6C0A mov eax, dword ptr fs:[00000030h] 3_2_019D6C0A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11C06 mov eax, dword ptr fs:[00000030h] 3_2_01A11C06
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A2740D mov eax, dword ptr fs:[00000030h] 3_2_01A2740D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A2740D mov eax, dword ptr fs:[00000030h] 3_2_01A2740D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A2740D mov eax, dword ptr fs:[00000030h] 3_2_01A2740D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198BC2C mov eax, dword ptr fs:[00000030h] 3_2_0198BC2C
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EC450 mov eax, dword ptr fs:[00000030h] 3_2_019EC450
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EC450 mov eax, dword ptr fs:[00000030h] 3_2_019EC450
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198A44B mov eax, dword ptr fs:[00000030h] 3_2_0198A44B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198AC7B mov eax, dword ptr fs:[00000030h] 3_2_0198AC7B
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197746D mov eax, dword ptr fs:[00000030h] 3_2_0197746D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01968794 mov eax, dword ptr fs:[00000030h] 3_2_01968794
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D7794 mov eax, dword ptr fs:[00000030h] 3_2_019D7794
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D7794 mov eax, dword ptr fs:[00000030h] 3_2_019D7794
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D7794 mov eax, dword ptr fs:[00000030h] 3_2_019D7794
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019937F5 mov eax, dword ptr fs:[00000030h] 3_2_019937F5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197F716 mov eax, dword ptr fs:[00000030h] 3_2_0197F716
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EFF10 mov eax, dword ptr fs:[00000030h] 3_2_019EFF10
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EFF10 mov eax, dword ptr fs:[00000030h] 3_2_019EFF10
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198A70E mov eax, dword ptr fs:[00000030h] 3_2_0198A70E
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198A70E mov eax, dword ptr fs:[00000030h] 3_2_0198A70E
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198E730 mov eax, dword ptr fs:[00000030h] 3_2_0198E730
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197B73D mov eax, dword ptr fs:[00000030h] 3_2_0197B73D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197B73D mov eax, dword ptr fs:[00000030h] 3_2_0197B73D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A2070D mov eax, dword ptr fs:[00000030h] 3_2_01A2070D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A2070D mov eax, dword ptr fs:[00000030h] 3_2_01A2070D
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01954F2E mov eax, dword ptr fs:[00000030h] 3_2_01954F2E
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01954F2E mov eax, dword ptr fs:[00000030h] 3_2_01954F2E
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A28F6A mov eax, dword ptr fs:[00000030h] 3_2_01A28F6A
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196EF40 mov eax, dword ptr fs:[00000030h] 3_2_0196EF40
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196FF60 mov eax, dword ptr fs:[00000030h] 3_2_0196FF60
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A20EA5 mov eax, dword ptr fs:[00000030h] 3_2_01A20EA5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A20EA5 mov eax, dword ptr fs:[00000030h] 3_2_01A20EA5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A20EA5 mov eax, dword ptr fs:[00000030h] 3_2_01A20EA5
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019EFE87 mov eax, dword ptr fs:[00000030h] 3_2_019EFE87
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019D46A7 mov eax, dword ptr fs:[00000030h] 3_2_019D46A7
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019836CC mov eax, dword ptr fs:[00000030h] 3_2_019836CC
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01998EC7 mov eax, dword ptr fs:[00000030h] 3_2_01998EC7
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A0FEC0 mov eax, dword ptr fs:[00000030h] 3_2_01A0FEC0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A28ED6 mov eax, dword ptr fs:[00000030h] 3_2_01A28ED6
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019676E2 mov eax, dword ptr fs:[00000030h] 3_2_019676E2
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_019816E0 mov ecx, dword ptr fs:[00000030h] 3_2_019816E0
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198A61C mov eax, dword ptr fs:[00000030h] 3_2_0198A61C
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0198A61C mov eax, dword ptr fs:[00000030h] 3_2_0198A61C
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195C600 mov eax, dword ptr fs:[00000030h] 3_2_0195C600
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195C600 mov eax, dword ptr fs:[00000030h] 3_2_0195C600
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195C600 mov eax, dword ptr fs:[00000030h] 3_2_0195C600
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01988E00 mov eax, dword ptr fs:[00000030h] 3_2_01988E00
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A0FE3F mov eax, dword ptr fs:[00000030h] 3_2_01A0FE3F
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A11608 mov eax, dword ptr fs:[00000030h] 3_2_01A11608
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0195E620 mov eax, dword ptr fs:[00000030h] 3_2_0195E620
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01967E41 mov eax, dword ptr fs:[00000030h] 3_2_01967E41
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01967E41 mov eax, dword ptr fs:[00000030h] 3_2_01967E41
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01967E41 mov eax, dword ptr fs:[00000030h] 3_2_01967E41
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01967E41 mov eax, dword ptr fs:[00000030h] 3_2_01967E41
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01967E41 mov eax, dword ptr fs:[00000030h] 3_2_01967E41
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01967E41 mov eax, dword ptr fs:[00000030h] 3_2_01967E41
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197AE73 mov eax, dword ptr fs:[00000030h] 3_2_0197AE73
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197AE73 mov eax, dword ptr fs:[00000030h] 3_2_0197AE73
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197AE73 mov eax, dword ptr fs:[00000030h] 3_2_0197AE73
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197AE73 mov eax, dword ptr fs:[00000030h] 3_2_0197AE73
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0197AE73 mov eax, dword ptr fs:[00000030h] 3_2_0197AE73
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1AE44 mov eax, dword ptr fs:[00000030h] 3_2_01A1AE44
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_01A1AE44 mov eax, dword ptr fs:[00000030h] 3_2_01A1AE44
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Code function: 3_2_0196766D mov eax, dword ptr fs:[00000030h] 3_2_0196766D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B1849B mov eax, dword ptr fs:[00000030h] 12_2_04B1849B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC4496 mov eax, dword ptr fs:[00000030h] 12_2_04BC4496
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC14FB mov eax, dword ptr fs:[00000030h] 12_2_04BC14FB
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86CF0 mov eax, dword ptr fs:[00000030h] 12_2_04B86CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86CF0 mov eax, dword ptr fs:[00000030h] 12_2_04B86CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86CF0 mov eax, dword ptr fs:[00000030h] 12_2_04B86CF0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD8CD6 mov eax, dword ptr fs:[00000030h] 12_2_04BD8CD6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3BC2C mov eax, dword ptr fs:[00000030h] 12_2_04B3BC2C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD740D mov eax, dword ptr fs:[00000030h] 12_2_04BD740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD740D mov eax, dword ptr fs:[00000030h] 12_2_04BD740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD740D mov eax, dword ptr fs:[00000030h] 12_2_04BD740D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86C0A mov eax, dword ptr fs:[00000030h] 12_2_04B86C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86C0A mov eax, dword ptr fs:[00000030h] 12_2_04B86C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86C0A mov eax, dword ptr fs:[00000030h] 12_2_04B86C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86C0A mov eax, dword ptr fs:[00000030h] 12_2_04B86C0A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1C06 mov eax, dword ptr fs:[00000030h] 12_2_04BC1C06
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3AC7B mov eax, dword ptr fs:[00000030h] 12_2_04B3AC7B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2746D mov eax, dword ptr fs:[00000030h] 12_2_04B2746D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B9C450 mov eax, dword ptr fs:[00000030h] 12_2_04B9C450
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B9C450 mov eax, dword ptr fs:[00000030h] 12_2_04B9C450
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3A44B mov eax, dword ptr fs:[00000030h] 12_2_04B3A44B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B31DB5 mov eax, dword ptr fs:[00000030h] 12_2_04B31DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B31DB5 mov eax, dword ptr fs:[00000030h] 12_2_04B31DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B31DB5 mov eax, dword ptr fs:[00000030h] 12_2_04B31DB5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD05AC mov eax, dword ptr fs:[00000030h] 12_2_04BD05AC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD05AC mov eax, dword ptr fs:[00000030h] 12_2_04BD05AC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B335A1 mov eax, dword ptr fs:[00000030h] 12_2_04B335A1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3FD9B mov eax, dword ptr fs:[00000030h] 12_2_04B3FD9B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3FD9B mov eax, dword ptr fs:[00000030h] 12_2_04B3FD9B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B32581 mov eax, dword ptr fs:[00000030h] 12_2_04B32581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B32581 mov eax, dword ptr fs:[00000030h] 12_2_04B32581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B32581 mov eax, dword ptr fs:[00000030h] 12_2_04B32581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B32581 mov eax, dword ptr fs:[00000030h] 12_2_04B32581
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B02D8A mov eax, dword ptr fs:[00000030h] 12_2_04B02D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B02D8A mov eax, dword ptr fs:[00000030h] 12_2_04B02D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B02D8A mov eax, dword ptr fs:[00000030h] 12_2_04B02D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B02D8A mov eax, dword ptr fs:[00000030h] 12_2_04B02D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B02D8A mov eax, dword ptr fs:[00000030h] 12_2_04B02D8A
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC2D82 mov eax, dword ptr fs:[00000030h] 12_2_04BC2D82
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC2D82 mov eax, dword ptr fs:[00000030h] 12_2_04BC2D82
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC2D82 mov eax, dword ptr fs:[00000030h] 12_2_04BC2D82
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC2D82 mov eax, dword ptr fs:[00000030h] 12_2_04BC2D82
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC2D82 mov eax, dword ptr fs:[00000030h] 12_2_04BC2D82
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC2D82 mov eax, dword ptr fs:[00000030h] 12_2_04BC2D82
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC2D82 mov eax, dword ptr fs:[00000030h] 12_2_04BC2D82
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BB8DF1 mov eax, dword ptr fs:[00000030h] 12_2_04BB8DF1
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B1D5E0 mov eax, dword ptr fs:[00000030h] 12_2_04B1D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B1D5E0 mov eax, dword ptr fs:[00000030h] 12_2_04B1D5E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCFDE2 mov eax, dword ptr fs:[00000030h] 12_2_04BCFDE2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCFDE2 mov eax, dword ptr fs:[00000030h] 12_2_04BCFDE2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCFDE2 mov eax, dword ptr fs:[00000030h] 12_2_04BCFDE2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCFDE2 mov eax, dword ptr fs:[00000030h] 12_2_04BCFDE2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86DC9 mov eax, dword ptr fs:[00000030h] 12_2_04B86DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86DC9 mov eax, dword ptr fs:[00000030h] 12_2_04B86DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86DC9 mov eax, dword ptr fs:[00000030h] 12_2_04B86DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86DC9 mov ecx, dword ptr fs:[00000030h] 12_2_04B86DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86DC9 mov eax, dword ptr fs:[00000030h] 12_2_04B86DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B86DC9 mov eax, dword ptr fs:[00000030h] 12_2_04B86DC9
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B0AD30 mov eax, dword ptr fs:[00000030h] 12_2_04B0AD30
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B13D34 mov eax, dword ptr fs:[00000030h] 12_2_04B13D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCE539 mov eax, dword ptr fs:[00000030h] 12_2_04BCE539
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B34D3B mov eax, dword ptr fs:[00000030h] 12_2_04B34D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B34D3B mov eax, dword ptr fs:[00000030h] 12_2_04B34D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B34D3B mov eax, dword ptr fs:[00000030h] 12_2_04B34D3B
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD8D34 mov eax, dword ptr fs:[00000030h] 12_2_04BD8D34
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B8A537 mov eax, dword ptr fs:[00000030h] 12_2_04B8A537
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2C577 mov eax, dword ptr fs:[00000030h] 12_2_04B2C577
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2C577 mov eax, dword ptr fs:[00000030h] 12_2_04B2C577
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B27D50 mov eax, dword ptr fs:[00000030h] 12_2_04B27D50
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B43D43 mov eax, dword ptr fs:[00000030h] 12_2_04B43D43
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B83540 mov eax, dword ptr fs:[00000030h] 12_2_04B83540
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BB3D40 mov eax, dword ptr fs:[00000030h] 12_2_04BB3D40
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD0EA5 mov eax, dword ptr fs:[00000030h] 12_2_04BD0EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD0EA5 mov eax, dword ptr fs:[00000030h] 12_2_04BD0EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD0EA5 mov eax, dword ptr fs:[00000030h] 12_2_04BD0EA5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B846A7 mov eax, dword ptr fs:[00000030h] 12_2_04B846A7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B9FE87 mov eax, dword ptr fs:[00000030h] 12_2_04B9FE87
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B316E0 mov ecx, dword ptr fs:[00000030h] 12_2_04B316E0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B176E2 mov eax, dword ptr fs:[00000030h] 12_2_04B176E2
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BD8ED6 mov eax, dword ptr fs:[00000030h] 12_2_04BD8ED6
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B48EC7 mov eax, dword ptr fs:[00000030h] 12_2_04B48EC7
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BBFEC0 mov eax, dword ptr fs:[00000030h] 12_2_04BBFEC0
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B336CC mov eax, dword ptr fs:[00000030h] 12_2_04B336CC
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BBFE3F mov eax, dword ptr fs:[00000030h] 12_2_04BBFE3F
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B0E620 mov eax, dword ptr fs:[00000030h] 12_2_04B0E620
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3A61C mov eax, dword ptr fs:[00000030h] 12_2_04B3A61C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3A61C mov eax, dword ptr fs:[00000030h] 12_2_04B3A61C
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B0C600 mov eax, dword ptr fs:[00000030h] 12_2_04B0C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B0C600 mov eax, dword ptr fs:[00000030h] 12_2_04B0C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B0C600 mov eax, dword ptr fs:[00000030h] 12_2_04B0C600
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B38E00 mov eax, dword ptr fs:[00000030h] 12_2_04B38E00
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BC1608 mov eax, dword ptr fs:[00000030h] 12_2_04BC1608
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2AE73 mov eax, dword ptr fs:[00000030h] 12_2_04B2AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2AE73 mov eax, dword ptr fs:[00000030h] 12_2_04B2AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2AE73 mov eax, dword ptr fs:[00000030h] 12_2_04B2AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2AE73 mov eax, dword ptr fs:[00000030h] 12_2_04B2AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2AE73 mov eax, dword ptr fs:[00000030h] 12_2_04B2AE73
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B1766D mov eax, dword ptr fs:[00000030h] 12_2_04B1766D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B17E41 mov eax, dword ptr fs:[00000030h] 12_2_04B17E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B17E41 mov eax, dword ptr fs:[00000030h] 12_2_04B17E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B17E41 mov eax, dword ptr fs:[00000030h] 12_2_04B17E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B17E41 mov eax, dword ptr fs:[00000030h] 12_2_04B17E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B17E41 mov eax, dword ptr fs:[00000030h] 12_2_04B17E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B17E41 mov eax, dword ptr fs:[00000030h] 12_2_04B17E41
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCAE44 mov eax, dword ptr fs:[00000030h] 12_2_04BCAE44
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04BCAE44 mov eax, dword ptr fs:[00000030h] 12_2_04BCAE44
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B18794 mov eax, dword ptr fs:[00000030h] 12_2_04B18794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B87794 mov eax, dword ptr fs:[00000030h] 12_2_04B87794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B87794 mov eax, dword ptr fs:[00000030h] 12_2_04B87794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B87794 mov eax, dword ptr fs:[00000030h] 12_2_04B87794
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B437F5 mov eax, dword ptr fs:[00000030h] 12_2_04B437F5
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B3E730 mov eax, dword ptr fs:[00000030h] 12_2_04B3E730
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2B73D mov eax, dword ptr fs:[00000030h] 12_2_04B2B73D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2B73D mov eax, dword ptr fs:[00000030h] 12_2_04B2B73D
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B04F2E mov eax, dword ptr fs:[00000030h] 12_2_04B04F2E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B04F2E mov eax, dword ptr fs:[00000030h] 12_2_04B04F2E
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B2F716 mov eax, dword ptr fs:[00000030h] 12_2_04B2F716
Source: C:\Windows\SysWOW64\raserver.exe Code function: 12_2_04B9FF10 mov eax, dword ptr fs:[00000030h] 12_2_04B9FF10
Enables debug privileges
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.gentrypartyof8.com
Source: C:\Windows\explorer.exe Domain query: www.rsyueda.com
Source: C:\Windows\explorer.exe Network Connect: 23.82.229.132 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 66.235.200.146 80 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Section loaded: unknown target: C:\Windows\SysWOW64\raserver.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Thread register set: target process: 3424 Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Section unmapped: C:\Windows\SysWOW64\raserver.exe base address: 1370000 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Process created: C:\Users\user\Desktop\XhU4EXUp0x.exe C:\Users\user\Desktop\XhU4EXUp0x.exe Jump to behavior
Source: C:\Windows\SysWOW64\raserver.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\XhU4EXUp0x.exe' Jump to behavior
Source: explorer.exe, 00000005.00000000.657818054.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.689362346.0000000001080000.00000002.00000001.sdmp, raserver.exe, 0000000C.00000002.912634794.0000000003390000.00000002.00000001.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.669694519.0000000005E50000.00000004.00000001.sdmp, raserver.exe, 0000000C.00000002.912634794.0000000003390000.00000002.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.689362346.0000000001080000.00000002.00000001.sdmp, raserver.exe, 0000000C.00000002.912634794.0000000003390000.00000002.00000001.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.689362346.0000000001080000.00000002.00000001.sdmp, raserver.exe, 0000000C.00000002.912634794.0000000003390000.00000002.00000001.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.677547132.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Queries volume information: C:\Users\user\Desktop\XhU4EXUp0x.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Runtime.Remoting\v4.0_4.0.0.0__b77a5c561934e089\System.Runtime.Remoting.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\XhU4EXUp0x.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.652221131.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.911907238.0000000000A90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.912137473.0000000000E80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.912162573.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.655856649.00000000037F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.706990052.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654291332.00000000036B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.707426607.0000000001600000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.XhU4EXUp0x.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XhU4EXUp0x.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.XhU4EXUp0x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XhU4EXUp0x.exe.400000.1.unpack, type: UNPACKEDPE

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 00000003.00000002.707404802.00000000015D0000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.652221131.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.911907238.0000000000A90000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.912137473.0000000000E80000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000C.00000002.912162573.0000000000EB0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.655856649.00000000037F7000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.706990052.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.654291332.00000000036B9000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.707426607.0000000001600000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 3.2.XhU4EXUp0x.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XhU4EXUp0x.exe.400000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.XhU4EXUp0x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.XhU4EXUp0x.exe.400000.1.unpack, type: UNPACKEDPE
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 433531 Sample: XhU4EXUp0x.exe Startdate: 12/06/2021 Architecture: WINDOWS Score: 100 36 Found malware configuration 2->36 38 Malicious sample detected (through community Yara rule) 2->38 40 Multi AV Scanner detection for submitted file 2->40 42 6 other signatures 2->42 10 XhU4EXUp0x.exe 3 2->10         started        process3 file4 28 C:\Users\user\AppData\...\XhU4EXUp0x.exe.log, ASCII 10->28 dropped 52 Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines) 10->52 54 Tries to detect virtualization through RDTSC time measurements 10->54 14 XhU4EXUp0x.exe 10->14         started        signatures5 process6 signatures7 56 Modifies the context of a thread in another process (thread injection) 14->56 58 Maps a DLL or memory area into another process 14->58 60 Sample uses process hollowing technique 14->60 62 Queues an APC in another process (thread injection) 14->62 17 explorer.exe 14->17 injected process8 dnsIp9 30 www.rsyueda.com 23.82.229.132, 49765, 80 LEASEWEB-USA-SEA-10US United States 17->30 32 gentrypartyof8.com 66.235.200.146, 49762, 80 CLOUDFLARENETUS United States 17->32 34 www.gentrypartyof8.com 17->34 44 System process connects to network (likely due to code injection or exploit) 17->44 21 raserver.exe 17->21         started        signatures10 process11 signatures12 46 Modifies the context of a thread in another process (thread injection) 21->46 48 Maps a DLL or memory area into another process 21->48 50 Tries to detect virtualization through RDTSC time measurements 21->50 24 cmd.exe 1 21->24         started        process13 process14 26 conhost.exe 24->26         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
66.235.200.146
 gentrypartyof8.com United States
13335 CLOUDFLARENETUS true
23.82.229.132
 www.rsyueda.com United States
396190 LEASEWEB-USA-SEA-10US true

Contacted Domains

Name IP Active
www.rsyueda.com 23.82.229.132 true
gentrypartyof8.com 66.235.200.146 true
www.gentrypartyof8.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.gentrypartyof8.com/nff/?2dWD=oo8PZR09GamqRkCLHSTg5AKJvm44C+19X1uEOPW4zTuWS3c9RrL+Vx+B8IkF2PxixF5c&7nSX=f2MHEhOHwH true
  • Avira URL Cloud: safe
 unknown
http://www.rsyueda.com/nff/?2dWD=rcekcafpraO0sj/oaoDcLlLwOdzHntpmaKyMQqwrcrTR8fOv+tmqTlrKj/r2WTcjy7/L&7nSX=f2MHEhOHwH true
  • Avira URL Cloud: safe
 unknown
www.yellow-wink.com/nff/ true
  • Avira URL Cloud: safe
 low