Windows Analysis Report PO 56720012359.exe

Overview

General Information

Sample Name: PO 56720012359.exe
Analysis ID: 483537
MD5: 839c75a88734aaf014ef0c3d77ce9109
SHA1: 10d79cb8e51fd30bfff63b2465ba0e111f6dd500
SHA256: 1829af596150521350d812c07f81226755d397e4755f649e083cc06de7d6f402
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Self deletion via cmd delete
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Sample file is different than original file name gathered from version info
Extensive use of GetProcAddress (often used to hide API calls)
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.allfyllofficial.com/b6cu/"], "decoy": ["sxdiyan.com", "web0084.com", "cpafirmspokane.com", "la-bio-geo.com", "chacrit.com", "stuntfighting.com", "rjsworkshop.com", "themillennialsfinest.com", "thefrontrealestate.com", "chairmn.com", "best1korea.com", "gudssutu.icu", "backupchip.net", "shrikanthamimports.com", "sportrecoverysleeve.com", "healthy-shack.com", "investperwear.com", "intertradeperu.com", "resonantonshop.com", "greghugheslaw.com", "instrumentum.store", "creative-cloud.info", "sansfoundations.com", "pmca.asia", "night.doctor", "19v5.com", "cmas.life", "yhanlikho.com", "kartikpatelrealtor.com", "viralpagi.com", "samsonengineeringco.com", "mh666.cool", "laboratoriosjj.com", "produklokal.com", "tjhysb.com", "solutions-oigroup.com", "chictarh.com", "gotmail.info", "yourvalue.online", "mylinkreview.com", "champonpowerequipment.com", "starcoupeownersindonesia.com", "buzagialtligi.com", "botol2-lasdnk.com", "blunss.info", "l3-construction.com", "fmodesign.com", "silkraga.com", "editimpact.com", "unionairjordanla.com", "lacageavin.com", "gushixiu.com", "cleanlast.com", "awvpvkmzxa.com", "xiaosandao.com", "nldcostmetics.com", "prosperitywithsoul.com", "kheticulture.com", "booksbykimberlyeandco.com", "creativehughes.com", "mobilewz.com", "arerasols.com", "w-hanaemi-personal.com", "dynamonetwork.com"]}
Multi AV Scanner detection for submitted file
Source: PO 56720012359.exe Virustotal: Detection: 50% Perma Link
Source: PO 56720012359.exe ReversingLabs: Detection: 40%
Yara detected FormBook
Source: Yara match File source: 1.2.PO 56720012359.exe.2d10000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO 56720012359.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO 56720012359.exe.2d10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO 56720012359.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.291418914.000000000708B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.507566355.0000000003540000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.275696203.000000000708B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.329627291.00000000015F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.505826920.0000000000DC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.252875789.0000000002D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.507780736.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328058419.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.allfyllofficial.com/b6cu/ Avira URL Cloud: Label: malware
Antivirus or Machine Learning detection for unpacked file
Source: 1.2.PO 56720012359.exe.2d10000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.PO 56720012359.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: PO 56720012359.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: PO 56720012359.exe Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: cscript.pdbUGP source: PO 56720012359.exe, 00000003.00000002.330426042.0000000003350000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: PO 56720012359.exe, 00000001.00000003.249848116.0000000002D80000.00000004.00000001.sdmp, PO 56720012359.exe, 00000003.00000002.328821788.00000000012C0000.00000040.00000001.sdmp, cscript.exe, 00000010.00000003.329208174.0000000005160000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: PO 56720012359.exe, cscript.exe
Source: Binary string: cscript.pdb source: PO 56720012359.exe, 00000003.00000002.330426042.0000000003350000.00000040.00020000.sdmp

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49782 -> 107.180.44.148:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49782 -> 107.180.44.148:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49782 -> 107.180.44.148:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49783 -> 50.87.144.47:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49783 -> 50.87.144.47:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.5:49783 -> 50.87.144.47:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 156.252.96.170 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.fmodesign.com
Source: C:\Windows\explorer.exe Domain query: www.healthy-shack.com
Source: C:\Windows\explorer.exe Domain query: www.arerasols.com
Source: C:\Windows\explorer.exe Network Connect: 154.81.100.18 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.180.44.148 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mobilewz.com
Source: C:\Windows\explorer.exe Network Connect: 23.252.68.226 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.stuntfighting.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.allfyllofficial.com/b6cu/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: POWERLINE-AS-APPOWERLINEDATACENTERHK POWERLINE-AS-APPOWERLINEDATACENTERHK
Source: Joe Sandbox View ASN Name: DXTL-HKDXTLTseungKwanOServiceHK DXTL-HKDXTLTseungKwanOServiceHK
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /b6cu/?y2=_npT80v0M2&L8fhOFRP=0cNTwCf3GfppWKB0T1XESIgtEFKjNX2tylJLJaVzm8N2XRqnUHRn8w7/tpdMCfw1z2P+ HTTP/1.1Host: www.stuntfighting.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /b6cu/?L8fhOFRP=v4/7wB6X+ne64BMfzkTnNfrtxR+fNWuSRi8sP9TYFcLz2AIA8KGD8NWIHbMwW3JjWqpf&y2=_npT80v0M2 HTTP/1.1Host: www.fmodesign.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /b6cu/?y2=_npT80v0M2&L8fhOFRP=PWSncnBGX0y4t94MIYhADTl/ZWH8Ec5DThT4C2sI40tRDeDzLuqQGdQiyNRL5TLkWfMz HTTP/1.1Host: www.healthy-shack.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Wed, 15 Sep 2021 06:36:29 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://findquickresultsnow.com/High_Speed_Internet.cfm?domain=allfyllofficial.com&fp=CDQ1BUiKVEwbYLN
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://findquickresultsnow.com/Parental_Control.cfm?domain=allfyllofficial.com&fp=CDQ1BUiKVEwbYLNmNk
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://findquickresultsnow.com/display.cfm
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://findquickresultsnow.com/px.js?ch=1
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://findquickresultsnow.com/px.js?ch=2
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://findquickresultsnow.com/sk-logabpstatus.php?a=NXM3Y25kMzZuSzNqUXBxY0xQbmloMGRRSnhhT3VRc1EvRkt
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.eot?#iefix
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.otf
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.svg#ubuntu-b
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.ttf
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-b/ubuntu-b.woff2
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.eot?#iefix
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.otf
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.svg#ubuntu-r
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.ttf
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/fonts/ubuntu-r/ubuntu-r.woff2
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/js/min.js?v2.2
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/arrow.png)
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/bodybg.png)
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/kwbg.jpg)
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/libg.png)
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/libgh.png)
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/logo.png)
Source: cscript.exe, 00000010.00000002.511976591.00000000059B2000.00000004.00020000.sdmp String found in binary or memory: http://i1.cdn-image.com/__media__/pics/12471/search-icon.png)
Source: cscript.exe, 00000010.00000002.508876093.0000000003683000.00000004.00000020.sdmp String found in binary or memory: http://www.mobilewz.com/
Source: cscript.exe, 00000010.00000002.508876093.0000000003683000.00000004.00000020.sdmp String found in binary or memory: http://www.mobilewz.com/user
Source: cscript.exe, 00000010.00000002.508876093.0000000003683000.00000004.00000020.sdmp String found in binary or memory: http://www.mobilewz.com/b6cu/?y2=_npT80v0M2&L8fhOFRP=hpZKB5Wc2v3dAucjERLG4WeGvlE/NyvmoCIino6AurWFNcX
Source: unknown DNS traffic detected: queries for: www.stuntfighting.com
Source: global traffic HTTP traffic detected: GET /b6cu/?y2=_npT80v0M2&L8fhOFRP=0cNTwCf3GfppWKB0T1XESIgtEFKjNX2tylJLJaVzm8N2XRqnUHRn8w7/tpdMCfw1z2P+ HTTP/1.1Host: www.stuntfighting.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /b6cu/?L8fhOFRP=v4/7wB6X+ne64BMfzkTnNfrtxR+fNWuSRi8sP9TYFcLz2AIA8KGD8NWIHbMwW3JjWqpf&y2=_npT80v0M2 HTTP/1.1Host: www.fmodesign.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /b6cu/?y2=_npT80v0M2&L8fhOFRP=PWSncnBGX0y4t94MIYhADTl/ZWH8Ec5DThT4C2sI40tRDeDzLuqQGdQiyNRL5TLkWfMz HTTP/1.1Host: www.healthy-shack.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 1.2.PO 56720012359.exe.2d10000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO 56720012359.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO 56720012359.exe.2d10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO 56720012359.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.291418914.000000000708B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.507566355.0000000003540000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.275696203.000000000708B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.329627291.00000000015F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.505826920.0000000000DC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.252875789.0000000002D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.507780736.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328058419.0000000000400000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 1.2.PO 56720012359.exe.2d10000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PO 56720012359.exe.2d10000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.PO 56720012359.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.PO 56720012359.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.PO 56720012359.exe.2d10000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.PO 56720012359.exe.2d10000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.PO 56720012359.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.PO 56720012359.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.291418914.000000000708B000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.291418914.000000000708B000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.507566355.0000000003540000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.507566355.0000000003540000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.275696203.000000000708B000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.275696203.000000000708B000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.329627291.00000000015F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.329627291.00000000015F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.505826920.0000000000DC0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.505826920.0000000000DC0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.252875789.0000000002D10000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.252875789.0000000002D10000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000010.00000002.507780736.0000000003570000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000010.00000002.507780736.0000000003570000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.328058419.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.328058419.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: PO 56720012359.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 1.2.PO 56720012359.exe.2d10000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PO 56720012359.exe.2d10000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.PO 56720012359.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.PO 56720012359.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.PO 56720012359.exe.2d10000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.PO 56720012359.exe.2d10000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.PO 56720012359.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.PO 56720012359.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.291418914.000000000708B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.291418914.000000000708B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.507566355.0000000003540000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.507566355.0000000003540000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.275696203.000000000708B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.275696203.000000000708B000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.329627291.00000000015F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.329627291.00000000015F0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.505826920.0000000000DC0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.505826920.0000000000DC0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.252875789.0000000002D10000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.252875789.0000000002D10000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000010.00000002.507780736.0000000003570000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000010.00000002.507780736.0000000003570000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.328058419.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.328058419.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B2FCD 1_2_008B2FCD
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008BB81D 1_2_008BB81D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008BA851 1_2_008BA851
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B9072 1_2_008B9072
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B95E4 1_2_008B95E4
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B8B00 1_2_008B8B00
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B795C 1_2_008B795C
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041C824 3_2_0041C824
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041B9D3 3_2_0041B9D3
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041C254 3_2_0041C254
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041CBD2 3_2_0041CBD2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00408C6B 3_2_00408C6B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00408C70 3_2_00408C70
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041CEBE 3_2_0041CEBE
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041BF72 3_2_0041BF72
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041B731 3_2_0041B731
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008BB81D 3_2_008BB81D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008BA851 3_2_008BA851
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B9072 3_2_008B9072
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B795C 3_2_008B795C
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B8B00 3_2_008B8B00
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B95E4 3_2_008B95E4
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B2FCD 3_2_008B2FCD
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01304120 3_2_01304120
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EF900 3_2_012EF900
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1002 3_2_013A1002
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013120A0 3_2_013120A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B20A8 3_2_013B20A8
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FB090 3_2_012FB090
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B28EC 3_2_013B28EC
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B2B28 3_2_013B2B28
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131EBB0 3_2_0131EBB0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013ADBD2 3_2_013ADBD2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B22AE 3_2_013B22AE
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E0D20 3_2_012E0D20
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B2D07 3_2_013B2D07
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B1D55 3_2_013B1D55
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312581 3_2_01312581
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FD5E0 3_2_012FD5E0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B25DD 3_2_013B25DD
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F841F 3_2_012F841F
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AD466 3_2_013AD466
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B1FF1 3_2_013B1FF1
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01306E30 3_2_01306E30
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AD616 3_2_013AD616
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B2EF7 3_2_013B2EF7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05320D20 16_2_05320D20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F2D07 16_2_053F2D07
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F1D55 16_2_053F1D55
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05352581 16_2_05352581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533D5E0 16_2_0533D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F25DD 16_2_053F25DD
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533841F 16_2_0533841F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053ED466 16_2_053ED466
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F1FF1 16_2_053F1FF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053FDFCE 16_2_053FDFCE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05346E30 16_2_05346E30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053ED616 16_2_053ED616
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F2EF7 16_2_053F2EF7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05344120 16_2_05344120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532F900 16_2_0532F900
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534A830 16_2_0534A830
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053FE824 16_2_053FE824
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1002 16_2_053E1002
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053520A0 16_2_053520A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F20A8 16_2_053F20A8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533B090 16_2_0533B090
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F28EC 16_2_053F28EC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F2B28 16_2_053F2B28
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534AB40 16_2_0534AB40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535EBB0 16_2_0535EBB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E03DA 16_2_053E03DA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053EDBD2 16_2_053EDBD2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053DFA2B 16_2_053DFA2B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F22AE 16_2_053F22AE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDC824 16_2_00DDC824
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDB9D3 16_2_00DDB9D3
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDC254 16_2_00DDC254
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DC8C70 16_2_00DC8C70
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DC8C6B 16_2_00DC8C6B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DC2D90 16_2_00DC2D90
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DC2FB0 16_2_00DC2FB0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDBF72 16_2_00DDBF72
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDB731 16_2_00DDB731
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: String function: 008B3B40 appears 42 times
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: String function: 012EB150 appears 35 times
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: String function: 008B42A1 appears 32 times
Source: C:\Windows\SysWOW64\cscript.exe Code function: String function: 0532B150 appears 66 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_004181D0 NtCreateFile, 3_2_004181D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00418280 NtReadFile, 3_2_00418280
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00418300 NtClose, 3_2_00418300
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_004183B0 NtAllocateVirtualMemory, 3_2_004183B0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_004181CA NtCreateFile, 3_2_004181CA
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041827A NtReadFile, 3_2_0041827A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_004182CA NtReadFile, 3_2_004182CA
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_004182FA NtClose, 3_2_004182FA
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_004183AB NtAllocateVirtualMemory, 3_2_004183AB
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_01329910
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013299A0 NtCreateSection,LdrInitializeThunk, 3_2_013299A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_01329860
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329840 NtDelayExecution,LdrInitializeThunk, 3_2_01329840
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013298F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_013298F0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329A20 NtResumeThread,LdrInitializeThunk, 3_2_01329A20
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_01329A00
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329A50 NtCreateFile,LdrInitializeThunk, 3_2_01329A50
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329540 NtReadFile,LdrInitializeThunk, 3_2_01329540
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013295D0 NtClose,LdrInitializeThunk, 3_2_013295D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329710 NtQueryInformationToken,LdrInitializeThunk, 3_2_01329710
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013297A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_013297A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329780 NtMapViewOfSection,LdrInitializeThunk, 3_2_01329780
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329FE0 NtCreateMutant,LdrInitializeThunk, 3_2_01329FE0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_01329660
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013296E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_013296E0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329950 NtQueueApcThread, 3_2_01329950
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013299D0 NtCreateProcessEx, 3_2_013299D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329820 NtEnumerateKey, 3_2_01329820
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0132B040 NtSuspendThread, 3_2_0132B040
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013298A0 NtWriteVirtualMemory, 3_2_013298A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329B00 NtSetValueKey, 3_2_01329B00
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0132A3B0 NtGetContextThread, 3_2_0132A3B0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329A10 NtQuerySection, 3_2_01329A10
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329A80 NtOpenDirectoryObject, 3_2_01329A80
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0132AD30 NtSetContextThread, 3_2_0132AD30
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329520 NtWaitForSingleObject, 3_2_01329520
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329560 NtWriteFile, 3_2_01329560
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013295F0 NtQueryInformationFile, 3_2_013295F0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329730 NtQueryVirtualMemory, 3_2_01329730
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0132A710 NtOpenProcessToken, 3_2_0132A710
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0132A770 NtOpenThread, 3_2_0132A770
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329770 NtSetInformationFile, 3_2_01329770
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329760 NtOpenProcess, 3_2_01329760
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329610 NtEnumerateValueKey, 3_2_01329610
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329670 NtQueryInformationProcess, 3_2_01329670
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01329650 NtQueryValueKey, 3_2_01329650
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013296D0 NtCreateKey, 3_2_013296D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369540 NtReadFile,LdrInitializeThunk, 16_2_05369540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053695D0 NtClose,LdrInitializeThunk, 16_2_053695D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369710 NtQueryInformationToken,LdrInitializeThunk, 16_2_05369710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369780 NtMapViewOfSection,LdrInitializeThunk, 16_2_05369780
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369FE0 NtCreateMutant,LdrInitializeThunk, 16_2_05369FE0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369660 NtAllocateVirtualMemory,LdrInitializeThunk, 16_2_05369660
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369650 NtQueryValueKey,LdrInitializeThunk, 16_2_05369650
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053696E0 NtFreeVirtualMemory,LdrInitializeThunk, 16_2_053696E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053696D0 NtCreateKey,LdrInitializeThunk, 16_2_053696D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369910 NtAdjustPrivilegesToken,LdrInitializeThunk, 16_2_05369910
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053699A0 NtCreateSection,LdrInitializeThunk, 16_2_053699A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369860 NtQuerySystemInformation,LdrInitializeThunk, 16_2_05369860
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369840 NtDelayExecution,LdrInitializeThunk, 16_2_05369840
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369A50 NtCreateFile,LdrInitializeThunk, 16_2_05369A50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0536AD30 NtSetContextThread, 16_2_0536AD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369520 NtWaitForSingleObject, 16_2_05369520
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369560 NtWriteFile, 16_2_05369560
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053695F0 NtQueryInformationFile, 16_2_053695F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369730 NtQueryVirtualMemory, 16_2_05369730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0536A710 NtOpenProcessToken, 16_2_0536A710
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0536A770 NtOpenThread, 16_2_0536A770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369770 NtSetInformationFile, 16_2_05369770
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369760 NtOpenProcess, 16_2_05369760
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053697A0 NtUnmapViewOfSection, 16_2_053697A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369610 NtEnumerateValueKey, 16_2_05369610
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369670 NtQueryInformationProcess, 16_2_05369670
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369950 NtQueueApcThread, 16_2_05369950
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053699D0 NtCreateProcessEx, 16_2_053699D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369820 NtEnumerateKey, 16_2_05369820
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0536B040 NtSuspendThread, 16_2_0536B040
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053698A0 NtWriteVirtualMemory, 16_2_053698A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053698F0 NtReadVirtualMemory, 16_2_053698F0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369B00 NtSetValueKey, 16_2_05369B00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0536A3B0 NtGetContextThread, 16_2_0536A3B0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369A20 NtResumeThread, 16_2_05369A20
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369A10 NtQuerySection, 16_2_05369A10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369A00 NtProtectVirtualMemory, 16_2_05369A00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05369A80 NtOpenDirectoryObject, 16_2_05369A80
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD81D0 NtCreateFile, 16_2_00DD81D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD8280 NtReadFile, 16_2_00DD8280
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD83B0 NtAllocateVirtualMemory, 16_2_00DD83B0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD8300 NtClose, 16_2_00DD8300
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD81CA NtCreateFile, 16_2_00DD81CA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD82CA NtReadFile, 16_2_00DD82CA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD82FA NtClose, 16_2_00DD82FA
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD827A NtReadFile, 16_2_00DD827A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD83AB NtAllocateVirtualMemory, 16_2_00DD83AB
Sample file is different than original file name gathered from version info
Source: PO 56720012359.exe, 00000001.00000003.247597225.0000000002FFF000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PO 56720012359.exe
Source: PO 56720012359.exe, 00000003.00000002.329509813.000000000156F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs PO 56720012359.exe
Source: PO 56720012359.exe, 00000003.00000002.330426042.0000000003350000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamecscript.exe` vs PO 56720012359.exe
Source: PO 56720012359.exe Virustotal: Detection: 50%
Source: PO 56720012359.exe ReversingLabs: Detection: 40%
Source: PO 56720012359.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\PO 56720012359.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\PO 56720012359.exe 'C:\Users\user\Desktop\PO 56720012359.exe'
Source: C:\Users\user\Desktop\PO 56720012359.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO 56720012359.exe Process created: C:\Users\user\Desktop\PO 56720012359.exe 'C:\Users\user\Desktop\PO 56720012359.exe'
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\cscript.exe C:\Windows\SysWOW64\cscript.exe
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO 56720012359.exe'
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\PO 56720012359.exe Process created: C:\Users\user\Desktop\PO 56720012359.exe 'C:\Users\user\Desktop\PO 56720012359.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO 56720012359.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{057EEE47-2572-4AA1-88D7-60CE2149E33C}\InProcServer32 Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/0@8/5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B1450 lstrlenW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,lstrlenW,StartServiceCtrlDispatcherW,GetLastError,GetProcessHeap,HeapFree, 1_2_008B1450
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B1450 lstrlenW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,lstrlenW,StartServiceCtrlDispatcherW,GetLastError,GetProcessHeap,HeapFree, 3_2_008B1450
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B1450 lstrlenW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,lstrlenW,StartServiceCtrlDispatcherW,GetLastError,GetProcessHeap,HeapFree, 1_2_008B1450
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6340:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:2940:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: PO 56720012359.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IMPORT
Source: PO 56720012359.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_RESOURCE
Source: PO 56720012359.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_BASERELOC
Source: PO 56720012359.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: PO 56720012359.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG
Source: PO 56720012359.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_IAT
Source: PO 56720012359.exe Static PE information: TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: PO 56720012359.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_DEBUG
Source: Binary string: cscript.pdbUGP source: PO 56720012359.exe, 00000003.00000002.330426042.0000000003350000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: PO 56720012359.exe, 00000001.00000003.249848116.0000000002D80000.00000004.00000001.sdmp, PO 56720012359.exe, 00000003.00000002.328821788.00000000012C0000.00000040.00000001.sdmp, cscript.exe, 00000010.00000003.329208174.0000000005160000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: PO 56720012359.exe, cscript.exe
Source: Binary string: cscript.pdb source: PO 56720012359.exe, 00000003.00000002.330426042.0000000003350000.00000040.00020000.sdmp
Source: PO 56720012359.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IMPORT is in: .rdata
Source: PO 56720012359.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_RESOURCE is in: .rsrc
Source: PO 56720012359.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_BASERELOC is in: .reloc
Source: PO 56720012359.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG is in: .rdata
Source: PO 56720012359.exe Static PE information: Data directory: IMAGE_DIRECTORY_ENTRY_IAT is in: .rdata

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B3B85 push ecx; ret 1_2_008B3B98
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00416087 push cs; ret 3_2_0041608A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041B9CF push edi; ret 3_2_0041B9D1
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041C9D1 push es; ret 3_2_0041C9D3
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00415262 push esp; iretd 3_2_00415263
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041B3C5 push eax; ret 3_2_0041B418
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041B47C push eax; ret 3_2_0041B482
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041B412 push eax; ret 3_2_0041B418
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0041B41B push eax; ret 3_2_0041B482
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00414FB9 pushad ; ret 3_2_00414FBF
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B3B85 push ecx; ret 3_2_008B3B98
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0133D0D1 push ecx; ret 3_2_0133D0E4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0537D0D1 push ecx; ret 16_2_0537D0E4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD6087 push cs; ret 16_2_00DD608A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDC9D1 push es; ret 16_2_00DDC9D3
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDB9CF push edi; ret 16_2_00DDB9D1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD5262 push esp; iretd 16_2_00DD5263
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDB3C5 push eax; ret 16_2_00DDB418
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDB47C push eax; ret 16_2_00DDB482
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDB41B push eax; ret 16_2_00DDB482
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DDB412 push eax; ret 16_2_00DDB418
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_00DD4FB9 pushad ; ret 16_2_00DD4FBF
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B1450 lstrlenW,GetProcessHeap,HeapAlloc,GetProcessHeap,HeapFree,lstrlenW,StartServiceCtrlDispatcherW,GetLastError,GetProcessHeap,HeapFree, 1_2_008B1450

Hooking and other Techniques for Hiding and Protection:

barindex
Icon mismatch, binary includes an icon from a different legit application in order to fool users
Source: initial sample Icon embedded in binary file: icon matches a legit application icon: download (15).png
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\cscript.exe Process created: /c del 'C:\Users\user\Desktop\PO 56720012359.exe'
Source: C:\Windows\SysWOW64\cscript.exe Process created: /c del 'C:\Users\user\Desktop\PO 56720012359.exe' Jump to behavior
Extensive use of GetProcAddress (often used to hide API calls)
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B2FCD RtlEncodePointer,__initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress, 1_2_008B2FCD
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\PO 56720012359.exe RDTSC instruction interceptor: First address: 00000000004085F4 second address: 00000000004085FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\PO 56720012359.exe RDTSC instruction interceptor: First address: 000000000040898E second address: 0000000000408994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000000DC85F4 second address: 0000000000DC85FA instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\cscript.exe RDTSC instruction interceptor: First address: 0000000000DC898E second address: 0000000000DC8994 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\cscript.exe TID: 6476 Thread sleep time: -30000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_004088C0 rdtsc 3_2_004088C0
Source: C:\Users\user\Desktop\PO 56720012359.exe Process information queried: ProcessInformation Jump to behavior
Source: explorer.exe, 00000005.00000000.315506357.0000000003710000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.273233836.0000000003767000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: cscript.exe, 00000010.00000002.508575985.000000000365E000.00000004.00000020.sdmp Binary or memory string: Hyper-V RAW
Source: explorer.exe, 00000005.00000000.272485902.00000000011B3000.00000004.00000020.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000tft\0
Source: explorer.exe, 00000005.00000000.278989155.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000%
Source: explorer.exe, 00000005.00000000.289003104.00000000053C4000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>'R\"
Source: explorer.exe, 00000005.00000000.278989155.00000000089B5000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&0000002

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B4E99 _memset,IsDebuggerPresent, 1_2_008B4E99
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B5AC5 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 1_2_008B5AC5
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B10B0 ExpandEnvironmentStringsW,GetLastError,GetProcessHeap,HeapAlloc,ExpandEnvironmentStringsW,GetLastError,GetProcessHeap,HeapFree, 1_2_008B10B0
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_004088C0 rdtsc 3_2_004088C0
Enables debug privileges
Source: C:\Users\user\Desktop\PO 56720012359.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131513A mov eax, dword ptr fs:[00000030h] 3_2_0131513A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131513A mov eax, dword ptr fs:[00000030h] 3_2_0131513A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01304120 mov eax, dword ptr fs:[00000030h] 3_2_01304120
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01304120 mov eax, dword ptr fs:[00000030h] 3_2_01304120
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01304120 mov eax, dword ptr fs:[00000030h] 3_2_01304120
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01304120 mov eax, dword ptr fs:[00000030h] 3_2_01304120
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01304120 mov ecx, dword ptr fs:[00000030h] 3_2_01304120
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E9100 mov eax, dword ptr fs:[00000030h] 3_2_012E9100
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E9100 mov eax, dword ptr fs:[00000030h] 3_2_012E9100
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E9100 mov eax, dword ptr fs:[00000030h] 3_2_012E9100
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EC962 mov eax, dword ptr fs:[00000030h] 3_2_012EC962
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EB171 mov eax, dword ptr fs:[00000030h] 3_2_012EB171
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EB171 mov eax, dword ptr fs:[00000030h] 3_2_012EB171
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130B944 mov eax, dword ptr fs:[00000030h] 3_2_0130B944
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130B944 mov eax, dword ptr fs:[00000030h] 3_2_0130B944
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013651BE mov eax, dword ptr fs:[00000030h] 3_2_013651BE
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013651BE mov eax, dword ptr fs:[00000030h] 3_2_013651BE
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013651BE mov eax, dword ptr fs:[00000030h] 3_2_013651BE
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013651BE mov eax, dword ptr fs:[00000030h] 3_2_013651BE
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013669A6 mov eax, dword ptr fs:[00000030h] 3_2_013669A6
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013161A0 mov eax, dword ptr fs:[00000030h] 3_2_013161A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013161A0 mov eax, dword ptr fs:[00000030h] 3_2_013161A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312990 mov eax, dword ptr fs:[00000030h] 3_2_01312990
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130C182 mov eax, dword ptr fs:[00000030h] 3_2_0130C182
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131A185 mov eax, dword ptr fs:[00000030h] 3_2_0131A185
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EB1E1 mov eax, dword ptr fs:[00000030h] 3_2_012EB1E1
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EB1E1 mov eax, dword ptr fs:[00000030h] 3_2_012EB1E1
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EB1E1 mov eax, dword ptr fs:[00000030h] 3_2_012EB1E1
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013741E8 mov eax, dword ptr fs:[00000030h] 3_2_013741E8
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FB02A mov eax, dword ptr fs:[00000030h] 3_2_012FB02A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FB02A mov eax, dword ptr fs:[00000030h] 3_2_012FB02A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FB02A mov eax, dword ptr fs:[00000030h] 3_2_012FB02A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FB02A mov eax, dword ptr fs:[00000030h] 3_2_012FB02A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131002D mov eax, dword ptr fs:[00000030h] 3_2_0131002D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131002D mov eax, dword ptr fs:[00000030h] 3_2_0131002D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131002D mov eax, dword ptr fs:[00000030h] 3_2_0131002D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131002D mov eax, dword ptr fs:[00000030h] 3_2_0131002D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131002D mov eax, dword ptr fs:[00000030h] 3_2_0131002D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01367016 mov eax, dword ptr fs:[00000030h] 3_2_01367016
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01367016 mov eax, dword ptr fs:[00000030h] 3_2_01367016
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01367016 mov eax, dword ptr fs:[00000030h] 3_2_01367016
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B4015 mov eax, dword ptr fs:[00000030h] 3_2_013B4015
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B4015 mov eax, dword ptr fs:[00000030h] 3_2_013B4015
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A2073 mov eax, dword ptr fs:[00000030h] 3_2_013A2073
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B1074 mov eax, dword ptr fs:[00000030h] 3_2_013B1074
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01300050 mov eax, dword ptr fs:[00000030h] 3_2_01300050
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01300050 mov eax, dword ptr fs:[00000030h] 3_2_01300050
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131F0BF mov ecx, dword ptr fs:[00000030h] 3_2_0131F0BF
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131F0BF mov eax, dword ptr fs:[00000030h] 3_2_0131F0BF
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131F0BF mov eax, dword ptr fs:[00000030h] 3_2_0131F0BF
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013120A0 mov eax, dword ptr fs:[00000030h] 3_2_013120A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013120A0 mov eax, dword ptr fs:[00000030h] 3_2_013120A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013120A0 mov eax, dword ptr fs:[00000030h] 3_2_013120A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013120A0 mov eax, dword ptr fs:[00000030h] 3_2_013120A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013120A0 mov eax, dword ptr fs:[00000030h] 3_2_013120A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013120A0 mov eax, dword ptr fs:[00000030h] 3_2_013120A0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013290AF mov eax, dword ptr fs:[00000030h] 3_2_013290AF
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E9080 mov eax, dword ptr fs:[00000030h] 3_2_012E9080
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01363884 mov eax, dword ptr fs:[00000030h] 3_2_01363884
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01363884 mov eax, dword ptr fs:[00000030h] 3_2_01363884
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E58EC mov eax, dword ptr fs:[00000030h] 3_2_012E58EC
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0137B8D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137B8D0 mov ecx, dword ptr fs:[00000030h] 3_2_0137B8D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0137B8D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0137B8D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0137B8D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0137B8D0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A131B mov eax, dword ptr fs:[00000030h] 3_2_013A131B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01313B7A mov eax, dword ptr fs:[00000030h] 3_2_01313B7A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01313B7A mov eax, dword ptr fs:[00000030h] 3_2_01313B7A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EDB60 mov ecx, dword ptr fs:[00000030h] 3_2_012EDB60
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B8B58 mov eax, dword ptr fs:[00000030h] 3_2_013B8B58
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EDB40 mov eax, dword ptr fs:[00000030h] 3_2_012EDB40
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EF358 mov eax, dword ptr fs:[00000030h] 3_2_012EF358
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01314BAD mov eax, dword ptr fs:[00000030h] 3_2_01314BAD
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01314BAD mov eax, dword ptr fs:[00000030h] 3_2_01314BAD
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01314BAD mov eax, dword ptr fs:[00000030h] 3_2_01314BAD
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B5BA5 mov eax, dword ptr fs:[00000030h] 3_2_013B5BA5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F1B8F mov eax, dword ptr fs:[00000030h] 3_2_012F1B8F
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F1B8F mov eax, dword ptr fs:[00000030h] 3_2_012F1B8F
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131B390 mov eax, dword ptr fs:[00000030h] 3_2_0131B390
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312397 mov eax, dword ptr fs:[00000030h] 3_2_01312397
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A138A mov eax, dword ptr fs:[00000030h] 3_2_013A138A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0139D380 mov ecx, dword ptr fs:[00000030h] 3_2_0139D380
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013103E2 mov eax, dword ptr fs:[00000030h] 3_2_013103E2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013103E2 mov eax, dword ptr fs:[00000030h] 3_2_013103E2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013103E2 mov eax, dword ptr fs:[00000030h] 3_2_013103E2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013103E2 mov eax, dword ptr fs:[00000030h] 3_2_013103E2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013103E2 mov eax, dword ptr fs:[00000030h] 3_2_013103E2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013103E2 mov eax, dword ptr fs:[00000030h] 3_2_013103E2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130DBE9 mov eax, dword ptr fs:[00000030h] 3_2_0130DBE9
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013653CA mov eax, dword ptr fs:[00000030h] 3_2_013653CA
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013653CA mov eax, dword ptr fs:[00000030h] 3_2_013653CA
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01324A2C mov eax, dword ptr fs:[00000030h] 3_2_01324A2C
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01324A2C mov eax, dword ptr fs:[00000030h] 3_2_01324A2C
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F8A0A mov eax, dword ptr fs:[00000030h] 3_2_012F8A0A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01303A1C mov eax, dword ptr fs:[00000030h] 3_2_01303A1C
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EAA16 mov eax, dword ptr fs:[00000030h] 3_2_012EAA16
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EAA16 mov eax, dword ptr fs:[00000030h] 3_2_012EAA16
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E5210 mov eax, dword ptr fs:[00000030h] 3_2_012E5210
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E5210 mov ecx, dword ptr fs:[00000030h] 3_2_012E5210
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E5210 mov eax, dword ptr fs:[00000030h] 3_2_012E5210
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E5210 mov eax, dword ptr fs:[00000030h] 3_2_012E5210
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0132927A mov eax, dword ptr fs:[00000030h] 3_2_0132927A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0139B260 mov eax, dword ptr fs:[00000030h] 3_2_0139B260
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0139B260 mov eax, dword ptr fs:[00000030h] 3_2_0139B260
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B8A62 mov eax, dword ptr fs:[00000030h] 3_2_013B8A62
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01374257 mov eax, dword ptr fs:[00000030h] 3_2_01374257
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E9240 mov eax, dword ptr fs:[00000030h] 3_2_012E9240
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E9240 mov eax, dword ptr fs:[00000030h] 3_2_012E9240
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E9240 mov eax, dword ptr fs:[00000030h] 3_2_012E9240
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E9240 mov eax, dword ptr fs:[00000030h] 3_2_012E9240
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AEA55 mov eax, dword ptr fs:[00000030h] 3_2_013AEA55
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131FAB0 mov eax, dword ptr fs:[00000030h] 3_2_0131FAB0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E52A5 mov eax, dword ptr fs:[00000030h] 3_2_012E52A5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E52A5 mov eax, dword ptr fs:[00000030h] 3_2_012E52A5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E52A5 mov eax, dword ptr fs:[00000030h] 3_2_012E52A5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E52A5 mov eax, dword ptr fs:[00000030h] 3_2_012E52A5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E52A5 mov eax, dword ptr fs:[00000030h] 3_2_012E52A5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FAAB0 mov eax, dword ptr fs:[00000030h] 3_2_012FAAB0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FAAB0 mov eax, dword ptr fs:[00000030h] 3_2_012FAAB0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131D294 mov eax, dword ptr fs:[00000030h] 3_2_0131D294
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131D294 mov eax, dword ptr fs:[00000030h] 3_2_0131D294
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312AE4 mov eax, dword ptr fs:[00000030h] 3_2_01312AE4
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312ACB mov eax, dword ptr fs:[00000030h] 3_2_01312ACB
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0136A537 mov eax, dword ptr fs:[00000030h] 3_2_0136A537
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AE539 mov eax, dword ptr fs:[00000030h] 3_2_013AE539
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01314D3B mov eax, dword ptr fs:[00000030h] 3_2_01314D3B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01314D3B mov eax, dword ptr fs:[00000030h] 3_2_01314D3B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01314D3B mov eax, dword ptr fs:[00000030h] 3_2_01314D3B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B8D34 mov eax, dword ptr fs:[00000030h] 3_2_013B8D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F3D34 mov eax, dword ptr fs:[00000030h] 3_2_012F3D34
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EAD30 mov eax, dword ptr fs:[00000030h] 3_2_012EAD30
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130C577 mov eax, dword ptr fs:[00000030h] 3_2_0130C577
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130C577 mov eax, dword ptr fs:[00000030h] 3_2_0130C577
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01307D50 mov eax, dword ptr fs:[00000030h] 3_2_01307D50
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01323D43 mov eax, dword ptr fs:[00000030h] 3_2_01323D43
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01363540 mov eax, dword ptr fs:[00000030h] 3_2_01363540
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01311DB5 mov eax, dword ptr fs:[00000030h] 3_2_01311DB5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01311DB5 mov eax, dword ptr fs:[00000030h] 3_2_01311DB5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01311DB5 mov eax, dword ptr fs:[00000030h] 3_2_01311DB5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013135A1 mov eax, dword ptr fs:[00000030h] 3_2_013135A1
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B05AC mov eax, dword ptr fs:[00000030h] 3_2_013B05AC
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B05AC mov eax, dword ptr fs:[00000030h] 3_2_013B05AC
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E2D8A mov eax, dword ptr fs:[00000030h] 3_2_012E2D8A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E2D8A mov eax, dword ptr fs:[00000030h] 3_2_012E2D8A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E2D8A mov eax, dword ptr fs:[00000030h] 3_2_012E2D8A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E2D8A mov eax, dword ptr fs:[00000030h] 3_2_012E2D8A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E2D8A mov eax, dword ptr fs:[00000030h] 3_2_012E2D8A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131FD9B mov eax, dword ptr fs:[00000030h] 3_2_0131FD9B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131FD9B mov eax, dword ptr fs:[00000030h] 3_2_0131FD9B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312581 mov eax, dword ptr fs:[00000030h] 3_2_01312581
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312581 mov eax, dword ptr fs:[00000030h] 3_2_01312581
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312581 mov eax, dword ptr fs:[00000030h] 3_2_01312581
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01312581 mov eax, dword ptr fs:[00000030h] 3_2_01312581
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01398DF1 mov eax, dword ptr fs:[00000030h] 3_2_01398DF1
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FD5E0 mov eax, dword ptr fs:[00000030h] 3_2_012FD5E0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FD5E0 mov eax, dword ptr fs:[00000030h] 3_2_012FD5E0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AFDE2 mov eax, dword ptr fs:[00000030h] 3_2_013AFDE2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AFDE2 mov eax, dword ptr fs:[00000030h] 3_2_013AFDE2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AFDE2 mov eax, dword ptr fs:[00000030h] 3_2_013AFDE2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AFDE2 mov eax, dword ptr fs:[00000030h] 3_2_013AFDE2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366DC9 mov eax, dword ptr fs:[00000030h] 3_2_01366DC9
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366DC9 mov eax, dword ptr fs:[00000030h] 3_2_01366DC9
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366DC9 mov eax, dword ptr fs:[00000030h] 3_2_01366DC9
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366DC9 mov ecx, dword ptr fs:[00000030h] 3_2_01366DC9
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366DC9 mov eax, dword ptr fs:[00000030h] 3_2_01366DC9
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366DC9 mov eax, dword ptr fs:[00000030h] 3_2_01366DC9
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131BC2C mov eax, dword ptr fs:[00000030h] 3_2_0131BC2C
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B740D mov eax, dword ptr fs:[00000030h] 3_2_013B740D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B740D mov eax, dword ptr fs:[00000030h] 3_2_013B740D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B740D mov eax, dword ptr fs:[00000030h] 3_2_013B740D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1C06 mov eax, dword ptr fs:[00000030h] 3_2_013A1C06
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366C0A mov eax, dword ptr fs:[00000030h] 3_2_01366C0A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366C0A mov eax, dword ptr fs:[00000030h] 3_2_01366C0A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366C0A mov eax, dword ptr fs:[00000030h] 3_2_01366C0A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366C0A mov eax, dword ptr fs:[00000030h] 3_2_01366C0A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130746D mov eax, dword ptr fs:[00000030h] 3_2_0130746D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137C450 mov eax, dword ptr fs:[00000030h] 3_2_0137C450
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137C450 mov eax, dword ptr fs:[00000030h] 3_2_0137C450
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131A44B mov eax, dword ptr fs:[00000030h] 3_2_0131A44B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F849B mov eax, dword ptr fs:[00000030h] 3_2_012F849B
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A14FB mov eax, dword ptr fs:[00000030h] 3_2_013A14FB
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366CF0 mov eax, dword ptr fs:[00000030h] 3_2_01366CF0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366CF0 mov eax, dword ptr fs:[00000030h] 3_2_01366CF0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01366CF0 mov eax, dword ptr fs:[00000030h] 3_2_01366CF0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B8CD6 mov eax, dword ptr fs:[00000030h] 3_2_013B8CD6
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E4F2E mov eax, dword ptr fs:[00000030h] 3_2_012E4F2E
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012E4F2E mov eax, dword ptr fs:[00000030h] 3_2_012E4F2E
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131E730 mov eax, dword ptr fs:[00000030h] 3_2_0131E730
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130F716 mov eax, dword ptr fs:[00000030h] 3_2_0130F716
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137FF10 mov eax, dword ptr fs:[00000030h] 3_2_0137FF10
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137FF10 mov eax, dword ptr fs:[00000030h] 3_2_0137FF10
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B070D mov eax, dword ptr fs:[00000030h] 3_2_013B070D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B070D mov eax, dword ptr fs:[00000030h] 3_2_013B070D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131A70E mov eax, dword ptr fs:[00000030h] 3_2_0131A70E
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131A70E mov eax, dword ptr fs:[00000030h] 3_2_0131A70E
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FFF60 mov eax, dword ptr fs:[00000030h] 3_2_012FFF60
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B8F6A mov eax, dword ptr fs:[00000030h] 3_2_013B8F6A
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012FEF40 mov eax, dword ptr fs:[00000030h] 3_2_012FEF40
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01367794 mov eax, dword ptr fs:[00000030h] 3_2_01367794
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01367794 mov eax, dword ptr fs:[00000030h] 3_2_01367794
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01367794 mov eax, dword ptr fs:[00000030h] 3_2_01367794
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F8794 mov eax, dword ptr fs:[00000030h] 3_2_012F8794
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013237F5 mov eax, dword ptr fs:[00000030h] 3_2_013237F5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0139FE3F mov eax, dword ptr fs:[00000030h] 3_2_0139FE3F
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EE620 mov eax, dword ptr fs:[00000030h] 3_2_012EE620
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131A61C mov eax, dword ptr fs:[00000030h] 3_2_0131A61C
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0131A61C mov eax, dword ptr fs:[00000030h] 3_2_0131A61C
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EC600 mov eax, dword ptr fs:[00000030h] 3_2_012EC600
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EC600 mov eax, dword ptr fs:[00000030h] 3_2_012EC600
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012EC600 mov eax, dword ptr fs:[00000030h] 3_2_012EC600
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01318E00 mov eax, dword ptr fs:[00000030h] 3_2_01318E00
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013A1608 mov eax, dword ptr fs:[00000030h] 3_2_013A1608
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F766D mov eax, dword ptr fs:[00000030h] 3_2_012F766D
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130AE73 mov eax, dword ptr fs:[00000030h] 3_2_0130AE73
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130AE73 mov eax, dword ptr fs:[00000030h] 3_2_0130AE73
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130AE73 mov eax, dword ptr fs:[00000030h] 3_2_0130AE73
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130AE73 mov eax, dword ptr fs:[00000030h] 3_2_0130AE73
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0130AE73 mov eax, dword ptr fs:[00000030h] 3_2_0130AE73
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F7E41 mov eax, dword ptr fs:[00000030h] 3_2_012F7E41
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F7E41 mov eax, dword ptr fs:[00000030h] 3_2_012F7E41
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F7E41 mov eax, dword ptr fs:[00000030h] 3_2_012F7E41
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F7E41 mov eax, dword ptr fs:[00000030h] 3_2_012F7E41
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F7E41 mov eax, dword ptr fs:[00000030h] 3_2_012F7E41
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F7E41 mov eax, dword ptr fs:[00000030h] 3_2_012F7E41
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AAE44 mov eax, dword ptr fs:[00000030h] 3_2_013AAE44
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013AAE44 mov eax, dword ptr fs:[00000030h] 3_2_013AAE44
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013646A7 mov eax, dword ptr fs:[00000030h] 3_2_013646A7
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B0EA5 mov eax, dword ptr fs:[00000030h] 3_2_013B0EA5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B0EA5 mov eax, dword ptr fs:[00000030h] 3_2_013B0EA5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B0EA5 mov eax, dword ptr fs:[00000030h] 3_2_013B0EA5
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0137FE87 mov eax, dword ptr fs:[00000030h] 3_2_0137FE87
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_012F76E2 mov eax, dword ptr fs:[00000030h] 3_2_012F76E2
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013116E0 mov ecx, dword ptr fs:[00000030h] 3_2_013116E0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013B8ED6 mov eax, dword ptr fs:[00000030h] 3_2_013B8ED6
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_01328EC7 mov eax, dword ptr fs:[00000030h] 3_2_01328EC7
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_0139FEC0 mov eax, dword ptr fs:[00000030h] 3_2_0139FEC0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_013136CC mov eax, dword ptr fs:[00000030h] 3_2_013136CC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532AD30 mov eax, dword ptr fs:[00000030h] 16_2_0532AD30
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05333D34 mov eax, dword ptr fs:[00000030h] 16_2_05333D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053EE539 mov eax, dword ptr fs:[00000030h] 16_2_053EE539
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F8D34 mov eax, dword ptr fs:[00000030h] 16_2_053F8D34
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053AA537 mov eax, dword ptr fs:[00000030h] 16_2_053AA537
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05354D3B mov eax, dword ptr fs:[00000030h] 16_2_05354D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05354D3B mov eax, dword ptr fs:[00000030h] 16_2_05354D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05354D3B mov eax, dword ptr fs:[00000030h] 16_2_05354D3B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534C577 mov eax, dword ptr fs:[00000030h] 16_2_0534C577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534C577 mov eax, dword ptr fs:[00000030h] 16_2_0534C577
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05347D50 mov eax, dword ptr fs:[00000030h] 16_2_05347D50
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05363D43 mov eax, dword ptr fs:[00000030h] 16_2_05363D43
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A3540 mov eax, dword ptr fs:[00000030h] 16_2_053A3540
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053D3D40 mov eax, dword ptr fs:[00000030h] 16_2_053D3D40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05351DB5 mov eax, dword ptr fs:[00000030h] 16_2_05351DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05351DB5 mov eax, dword ptr fs:[00000030h] 16_2_05351DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05351DB5 mov eax, dword ptr fs:[00000030h] 16_2_05351DB5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F05AC mov eax, dword ptr fs:[00000030h] 16_2_053F05AC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F05AC mov eax, dword ptr fs:[00000030h] 16_2_053F05AC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053535A1 mov eax, dword ptr fs:[00000030h] 16_2_053535A1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535FD9B mov eax, dword ptr fs:[00000030h] 16_2_0535FD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535FD9B mov eax, dword ptr fs:[00000030h] 16_2_0535FD9B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05352581 mov eax, dword ptr fs:[00000030h] 16_2_05352581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05352581 mov eax, dword ptr fs:[00000030h] 16_2_05352581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05352581 mov eax, dword ptr fs:[00000030h] 16_2_05352581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05352581 mov eax, dword ptr fs:[00000030h] 16_2_05352581
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05322D8A mov eax, dword ptr fs:[00000030h] 16_2_05322D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05322D8A mov eax, dword ptr fs:[00000030h] 16_2_05322D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05322D8A mov eax, dword ptr fs:[00000030h] 16_2_05322D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05322D8A mov eax, dword ptr fs:[00000030h] 16_2_05322D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05322D8A mov eax, dword ptr fs:[00000030h] 16_2_05322D8A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053D8DF1 mov eax, dword ptr fs:[00000030h] 16_2_053D8DF1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533D5E0 mov eax, dword ptr fs:[00000030h] 16_2_0533D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533D5E0 mov eax, dword ptr fs:[00000030h] 16_2_0533D5E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053EFDE2 mov eax, dword ptr fs:[00000030h] 16_2_053EFDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053EFDE2 mov eax, dword ptr fs:[00000030h] 16_2_053EFDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053EFDE2 mov eax, dword ptr fs:[00000030h] 16_2_053EFDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053EFDE2 mov eax, dword ptr fs:[00000030h] 16_2_053EFDE2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6DC9 mov eax, dword ptr fs:[00000030h] 16_2_053A6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6DC9 mov eax, dword ptr fs:[00000030h] 16_2_053A6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6DC9 mov eax, dword ptr fs:[00000030h] 16_2_053A6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6DC9 mov ecx, dword ptr fs:[00000030h] 16_2_053A6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6DC9 mov eax, dword ptr fs:[00000030h] 16_2_053A6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6DC9 mov eax, dword ptr fs:[00000030h] 16_2_053A6DC9
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535BC2C mov eax, dword ptr fs:[00000030h] 16_2_0535BC2C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6C0A mov eax, dword ptr fs:[00000030h] 16_2_053A6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6C0A mov eax, dword ptr fs:[00000030h] 16_2_053A6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6C0A mov eax, dword ptr fs:[00000030h] 16_2_053A6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6C0A mov eax, dword ptr fs:[00000030h] 16_2_053A6C0A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F740D mov eax, dword ptr fs:[00000030h] 16_2_053F740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F740D mov eax, dword ptr fs:[00000030h] 16_2_053F740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F740D mov eax, dword ptr fs:[00000030h] 16_2_053F740D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1C06 mov eax, dword ptr fs:[00000030h] 16_2_053E1C06
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534746D mov eax, dword ptr fs:[00000030h] 16_2_0534746D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BC450 mov eax, dword ptr fs:[00000030h] 16_2_053BC450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BC450 mov eax, dword ptr fs:[00000030h] 16_2_053BC450
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535A44B mov eax, dword ptr fs:[00000030h] 16_2_0535A44B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533849B mov eax, dword ptr fs:[00000030h] 16_2_0533849B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E14FB mov eax, dword ptr fs:[00000030h] 16_2_053E14FB
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6CF0 mov eax, dword ptr fs:[00000030h] 16_2_053A6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6CF0 mov eax, dword ptr fs:[00000030h] 16_2_053A6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A6CF0 mov eax, dword ptr fs:[00000030h] 16_2_053A6CF0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F8CD6 mov eax, dword ptr fs:[00000030h] 16_2_053F8CD6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535E730 mov eax, dword ptr fs:[00000030h] 16_2_0535E730
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05324F2E mov eax, dword ptr fs:[00000030h] 16_2_05324F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05324F2E mov eax, dword ptr fs:[00000030h] 16_2_05324F2E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534F716 mov eax, dword ptr fs:[00000030h] 16_2_0534F716
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BFF10 mov eax, dword ptr fs:[00000030h] 16_2_053BFF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BFF10 mov eax, dword ptr fs:[00000030h] 16_2_053BFF10
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F070D mov eax, dword ptr fs:[00000030h] 16_2_053F070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F070D mov eax, dword ptr fs:[00000030h] 16_2_053F070D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535A70E mov eax, dword ptr fs:[00000030h] 16_2_0535A70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535A70E mov eax, dword ptr fs:[00000030h] 16_2_0535A70E
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533FF60 mov eax, dword ptr fs:[00000030h] 16_2_0533FF60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F8F6A mov eax, dword ptr fs:[00000030h] 16_2_053F8F6A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533EF40 mov eax, dword ptr fs:[00000030h] 16_2_0533EF40
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05338794 mov eax, dword ptr fs:[00000030h] 16_2_05338794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A7794 mov eax, dword ptr fs:[00000030h] 16_2_053A7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A7794 mov eax, dword ptr fs:[00000030h] 16_2_053A7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A7794 mov eax, dword ptr fs:[00000030h] 16_2_053A7794
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053637F5 mov eax, dword ptr fs:[00000030h] 16_2_053637F5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053DFE3F mov eax, dword ptr fs:[00000030h] 16_2_053DFE3F
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532E620 mov eax, dword ptr fs:[00000030h] 16_2_0532E620
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535A61C mov eax, dword ptr fs:[00000030h] 16_2_0535A61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535A61C mov eax, dword ptr fs:[00000030h] 16_2_0535A61C
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532C600 mov eax, dword ptr fs:[00000030h] 16_2_0532C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532C600 mov eax, dword ptr fs:[00000030h] 16_2_0532C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532C600 mov eax, dword ptr fs:[00000030h] 16_2_0532C600
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05358E00 mov eax, dword ptr fs:[00000030h] 16_2_05358E00
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E1608 mov eax, dword ptr fs:[00000030h] 16_2_053E1608
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534AE73 mov eax, dword ptr fs:[00000030h] 16_2_0534AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534AE73 mov eax, dword ptr fs:[00000030h] 16_2_0534AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534AE73 mov eax, dword ptr fs:[00000030h] 16_2_0534AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534AE73 mov eax, dword ptr fs:[00000030h] 16_2_0534AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534AE73 mov eax, dword ptr fs:[00000030h] 16_2_0534AE73
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533766D mov eax, dword ptr fs:[00000030h] 16_2_0533766D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05337E41 mov eax, dword ptr fs:[00000030h] 16_2_05337E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05337E41 mov eax, dword ptr fs:[00000030h] 16_2_05337E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05337E41 mov eax, dword ptr fs:[00000030h] 16_2_05337E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05337E41 mov eax, dword ptr fs:[00000030h] 16_2_05337E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05337E41 mov eax, dword ptr fs:[00000030h] 16_2_05337E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05337E41 mov eax, dword ptr fs:[00000030h] 16_2_05337E41
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053EAE44 mov eax, dword ptr fs:[00000030h] 16_2_053EAE44
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053EAE44 mov eax, dword ptr fs:[00000030h] 16_2_053EAE44
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F0EA5 mov eax, dword ptr fs:[00000030h] 16_2_053F0EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F0EA5 mov eax, dword ptr fs:[00000030h] 16_2_053F0EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F0EA5 mov eax, dword ptr fs:[00000030h] 16_2_053F0EA5
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A46A7 mov eax, dword ptr fs:[00000030h] 16_2_053A46A7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BFE87 mov eax, dword ptr fs:[00000030h] 16_2_053BFE87
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053376E2 mov eax, dword ptr fs:[00000030h] 16_2_053376E2
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053516E0 mov ecx, dword ptr fs:[00000030h] 16_2_053516E0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F8ED6 mov eax, dword ptr fs:[00000030h] 16_2_053F8ED6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05368EC7 mov eax, dword ptr fs:[00000030h] 16_2_05368EC7
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053536CC mov eax, dword ptr fs:[00000030h] 16_2_053536CC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053DFEC0 mov eax, dword ptr fs:[00000030h] 16_2_053DFEC0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535513A mov eax, dword ptr fs:[00000030h] 16_2_0535513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535513A mov eax, dword ptr fs:[00000030h] 16_2_0535513A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05344120 mov eax, dword ptr fs:[00000030h] 16_2_05344120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05344120 mov eax, dword ptr fs:[00000030h] 16_2_05344120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05344120 mov eax, dword ptr fs:[00000030h] 16_2_05344120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05344120 mov eax, dword ptr fs:[00000030h] 16_2_05344120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05344120 mov ecx, dword ptr fs:[00000030h] 16_2_05344120
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05329100 mov eax, dword ptr fs:[00000030h] 16_2_05329100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05329100 mov eax, dword ptr fs:[00000030h] 16_2_05329100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05329100 mov eax, dword ptr fs:[00000030h] 16_2_05329100
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532B171 mov eax, dword ptr fs:[00000030h] 16_2_0532B171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532B171 mov eax, dword ptr fs:[00000030h] 16_2_0532B171
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532C962 mov eax, dword ptr fs:[00000030h] 16_2_0532C962
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534B944 mov eax, dword ptr fs:[00000030h] 16_2_0534B944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534B944 mov eax, dword ptr fs:[00000030h] 16_2_0534B944
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A51BE mov eax, dword ptr fs:[00000030h] 16_2_053A51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A51BE mov eax, dword ptr fs:[00000030h] 16_2_053A51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A51BE mov eax, dword ptr fs:[00000030h] 16_2_053A51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A51BE mov eax, dword ptr fs:[00000030h] 16_2_053A51BE
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov ecx, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov ecx, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov eax, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov ecx, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov ecx, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov eax, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov ecx, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov ecx, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov eax, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov ecx, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov ecx, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053499BF mov eax, dword ptr fs:[00000030h] 16_2_053499BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053561A0 mov eax, dword ptr fs:[00000030h] 16_2_053561A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053561A0 mov eax, dword ptr fs:[00000030h] 16_2_053561A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E49A4 mov eax, dword ptr fs:[00000030h] 16_2_053E49A4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E49A4 mov eax, dword ptr fs:[00000030h] 16_2_053E49A4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E49A4 mov eax, dword ptr fs:[00000030h] 16_2_053E49A4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E49A4 mov eax, dword ptr fs:[00000030h] 16_2_053E49A4
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A69A6 mov eax, dword ptr fs:[00000030h] 16_2_053A69A6
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05352990 mov eax, dword ptr fs:[00000030h] 16_2_05352990
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535A185 mov eax, dword ptr fs:[00000030h] 16_2_0535A185
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534C182 mov eax, dword ptr fs:[00000030h] 16_2_0534C182
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053B41E8 mov eax, dword ptr fs:[00000030h] 16_2_053B41E8
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532B1E1 mov eax, dword ptr fs:[00000030h] 16_2_0532B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532B1E1 mov eax, dword ptr fs:[00000030h] 16_2_0532B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532B1E1 mov eax, dword ptr fs:[00000030h] 16_2_0532B1E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534A830 mov eax, dword ptr fs:[00000030h] 16_2_0534A830
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534A830 mov eax, dword ptr fs:[00000030h] 16_2_0534A830
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534A830 mov eax, dword ptr fs:[00000030h] 16_2_0534A830
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0534A830 mov eax, dword ptr fs:[00000030h] 16_2_0534A830
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535002D mov eax, dword ptr fs:[00000030h] 16_2_0535002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535002D mov eax, dword ptr fs:[00000030h] 16_2_0535002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535002D mov eax, dword ptr fs:[00000030h] 16_2_0535002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535002D mov eax, dword ptr fs:[00000030h] 16_2_0535002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535002D mov eax, dword ptr fs:[00000030h] 16_2_0535002D
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533B02A mov eax, dword ptr fs:[00000030h] 16_2_0533B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533B02A mov eax, dword ptr fs:[00000030h] 16_2_0533B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533B02A mov eax, dword ptr fs:[00000030h] 16_2_0533B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0533B02A mov eax, dword ptr fs:[00000030h] 16_2_0533B02A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F4015 mov eax, dword ptr fs:[00000030h] 16_2_053F4015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F4015 mov eax, dword ptr fs:[00000030h] 16_2_053F4015
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A7016 mov eax, dword ptr fs:[00000030h] 16_2_053A7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A7016 mov eax, dword ptr fs:[00000030h] 16_2_053A7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A7016 mov eax, dword ptr fs:[00000030h] 16_2_053A7016
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F1074 mov eax, dword ptr fs:[00000030h] 16_2_053F1074
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E2073 mov eax, dword ptr fs:[00000030h] 16_2_053E2073
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05340050 mov eax, dword ptr fs:[00000030h] 16_2_05340050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05340050 mov eax, dword ptr fs:[00000030h] 16_2_05340050
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535F0BF mov ecx, dword ptr fs:[00000030h] 16_2_0535F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535F0BF mov eax, dword ptr fs:[00000030h] 16_2_0535F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0535F0BF mov eax, dword ptr fs:[00000030h] 16_2_0535F0BF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053520A0 mov eax, dword ptr fs:[00000030h] 16_2_053520A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053520A0 mov eax, dword ptr fs:[00000030h] 16_2_053520A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053520A0 mov eax, dword ptr fs:[00000030h] 16_2_053520A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053520A0 mov eax, dword ptr fs:[00000030h] 16_2_053520A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053520A0 mov eax, dword ptr fs:[00000030h] 16_2_053520A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053520A0 mov eax, dword ptr fs:[00000030h] 16_2_053520A0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053690AF mov eax, dword ptr fs:[00000030h] 16_2_053690AF
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05329080 mov eax, dword ptr fs:[00000030h] 16_2_05329080
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A3884 mov eax, dword ptr fs:[00000030h] 16_2_053A3884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053A3884 mov eax, dword ptr fs:[00000030h] 16_2_053A3884
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053240E1 mov eax, dword ptr fs:[00000030h] 16_2_053240E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053240E1 mov eax, dword ptr fs:[00000030h] 16_2_053240E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053240E1 mov eax, dword ptr fs:[00000030h] 16_2_053240E1
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053258EC mov eax, dword ptr fs:[00000030h] 16_2_053258EC
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BB8D0 mov eax, dword ptr fs:[00000030h] 16_2_053BB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BB8D0 mov ecx, dword ptr fs:[00000030h] 16_2_053BB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BB8D0 mov eax, dword ptr fs:[00000030h] 16_2_053BB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BB8D0 mov eax, dword ptr fs:[00000030h] 16_2_053BB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BB8D0 mov eax, dword ptr fs:[00000030h] 16_2_053BB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053BB8D0 mov eax, dword ptr fs:[00000030h] 16_2_053BB8D0
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053E131B mov eax, dword ptr fs:[00000030h] 16_2_053E131B
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05353B7A mov eax, dword ptr fs:[00000030h] 16_2_05353B7A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_05353B7A mov eax, dword ptr fs:[00000030h] 16_2_05353B7A
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532DB60 mov ecx, dword ptr fs:[00000030h] 16_2_0532DB60
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_053F8B58 mov eax, dword ptr fs:[00000030h] 16_2_053F8B58
Source: C:\Windows\SysWOW64\cscript.exe Code function: 16_2_0532F358 mov eax, dword ptr fs:[00000030h] 16_2_0532F358
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\PO 56720012359.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_00409B30 LdrLoadDll, 3_2_00409B30
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B40F0 SetUnhandledExceptionFilter, 1_2_008B40F0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B4121 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 1_2_008B4121
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B40F0 SetUnhandledExceptionFilter, 3_2_008B40F0
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 3_2_008B4121 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 3_2_008B4121

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 156.252.96.170 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.fmodesign.com
Source: C:\Windows\explorer.exe Domain query: www.healthy-shack.com
Source: C:\Windows\explorer.exe Domain query: www.arerasols.com
Source: C:\Windows\explorer.exe Network Connect: 154.81.100.18 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 107.180.44.148 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mobilewz.com
Source: C:\Windows\explorer.exe Network Connect: 23.252.68.226 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.stuntfighting.com
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\PO 56720012359.exe Section unmapped: C:\Windows\SysWOW64\cscript.exe base address: 1210000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\PO 56720012359.exe Section loaded: unknown target: C:\Users\user\Desktop\PO 56720012359.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO 56720012359.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO 56720012359.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO 56720012359.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\PO 56720012359.exe Section loaded: unknown target: C:\Windows\SysWOW64\cscript.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\PO 56720012359.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\PO 56720012359.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Users\user\Desktop\PO 56720012359.exe Thread register set: target process: 3472 Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Thread register set: target process: 3472 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\PO 56720012359.exe Process created: C:\Users\user\Desktop\PO 56720012359.exe 'C:\Users\user\Desktop\PO 56720012359.exe' Jump to behavior
Source: C:\Windows\SysWOW64\cscript.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del 'C:\Users\user\Desktop\PO 56720012359.exe' Jump to behavior
Source: explorer.exe, 00000005.00000000.314610609.0000000001640000.00000002.00020000.sdmp, cscript.exe, 00000010.00000002.509351340.0000000003BB0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.314610609.0000000001640000.00000002.00020000.sdmp, cscript.exe, 00000010.00000002.509351340.0000000003BB0000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.314610609.0000000001640000.00000002.00020000.sdmp, cscript.exe, 00000010.00000002.509351340.0000000003BB0000.00000002.00020000.sdmp Binary or memory string: SProgram Managerl
Source: explorer.exe, 00000005.00000000.255386675.0000000001128000.00000004.00000020.sdmp Binary or memory string: ProgmanOMEa
Source: explorer.exe, 00000005.00000000.314610609.0000000001640000.00000002.00020000.sdmp, cscript.exe, 00000010.00000002.509351340.0000000003BB0000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd,
Source: explorer.exe, 00000005.00000000.314610609.0000000001640000.00000002.00020000.sdmp, cscript.exe, 00000010.00000002.509351340.0000000003BB0000.00000002.00020000.sdmp Binary or memory string: Progmanlock

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B74BC cpuid 1_2_008B74BC
Source: C:\Users\user\Desktop\PO 56720012359.exe Code function: 1_2_008B3A01 GetSystemTimeAsFileTime,GetCurrentThreadId,GetCurrentProcessId,QueryPerformanceCounter, 1_2_008B3A01

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 1.2.PO 56720012359.exe.2d10000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO 56720012359.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO 56720012359.exe.2d10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO 56720012359.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.291418914.000000000708B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.507566355.0000000003540000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.275696203.000000000708B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.329627291.00000000015F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.505826920.0000000000DC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.252875789.0000000002D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.507780736.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328058419.0000000000400000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 1.2.PO 56720012359.exe.2d10000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO 56720012359.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.PO 56720012359.exe.2d10000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.PO 56720012359.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.291418914.000000000708B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328750105.0000000001280000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.507566355.0000000003540000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.275696203.000000000708B000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.329627291.00000000015F0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.505826920.0000000000DC0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.252875789.0000000002D10000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000010.00000002.507780736.0000000003570000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.328058419.0000000000400000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 483537 Sample: PO 56720012359.exe Startdate: 15/09/2021 Architecture: WINDOWS Score: 100 31 www.la-bio-geo.com 2->31 33 www.allfyllofficial.com 2->33 45 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->45 47 Found malware configuration 2->47 49 Malicious sample detected (through community Yara rule) 2->49 51 6 other signatures 2->51 11 PO 56720012359.exe 1 2->11         started        signatures3 process4 signatures5 63 Maps a DLL or memory area into another process 11->63 14 PO 56720012359.exe 11->14         started        17 conhost.exe 11->17         started        process6 signatures7 65 Modifies the context of a thread in another process (thread injection) 14->65 67 Maps a DLL or memory area into another process 14->67 69 Sample uses process hollowing technique 14->69 71 Queues an APC in another process (thread injection) 14->71 19 explorer.exe 14->19 injected process8 dnsIp9 35 www.mobilewz.com 23.252.68.226, 80 SAYFANETTR Turkey 19->35 37 www.stuntfighting.com 156.252.96.170, 49774, 80 POWERLINE-AS-APPOWERLINEDATACENTERHK Seychelles 19->37 39 4 other IPs or domains 19->39 53 System process connects to network (likely due to code injection or exploit) 19->53 23 cscript.exe 12 19->23         started        signatures10 process11 dnsIp12 41 www.mobilewz.com 23->41 43 192.168.2.1 unknown unknown 23->43 55 Self deletion via cmd delete 23->55 57 Modifies the context of a thread in another process (thread injection) 23->57 59 Maps a DLL or memory area into another process 23->59 61 Tries to detect virtualization through RDTSC time measurements 23->61 27 cmd.exe 1 23->27         started        signatures13 process14 process15 29 conhost.exe 27->29         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
156.252.96.170
 www.stuntfighting.com Seychelles
132839 POWERLINE-AS-APPOWERLINEDATACENTERHK true
154.81.100.18
 www.fmodesign.com Seychelles
134548 DXTL-HKDXTLTseungKwanOServiceHK true
107.180.44.148
 healthy-shack.com United States
26496 AS-26496-GO-DADDY-COM-LLCUS true
23.252.68.226
 www.mobilewz.com Turkey
59447 SAYFANETTR true

Private
IP
192.168.2.1

Contacted Domains

Name IP Active
www.mobilewz.com 23.252.68.226 true
www.fmodesign.com 154.81.100.18 true
healthy-shack.com 107.180.44.148 true
www.allfyllofficial.com 50.87.144.47 true
www.stuntfighting.com 156.252.96.170 true
www.la-bio-geo.com unknown unknown
www.healthy-shack.com unknown unknown
www.arerasols.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.stuntfighting.com/b6cu/?y2=_npT80v0M2&L8fhOFRP=0cNTwCf3GfppWKB0T1XESIgtEFKjNX2tylJLJaVzm8N2XRqnUHRn8w7/tpdMCfw1z2P+ true
  • Avira URL Cloud: safe
 unknown
http://www.fmodesign.com/b6cu/?L8fhOFRP=v4/7wB6X+ne64BMfzkTnNfrtxR+fNWuSRi8sP9TYFcLz2AIA8KGD8NWIHbMwW3JjWqpf&y2=_npT80v0M2 true
  • Avira URL Cloud: safe
 unknown
www.allfyllofficial.com/b6cu/ true
  • Avira URL Cloud: malware
 low
http://www.healthy-shack.com/b6cu/?y2=_npT80v0M2&L8fhOFRP=PWSncnBGX0y4t94MIYhADTl/ZWH8Ec5DThT4C2sI40tRDeDzLuqQGdQiyNRL5TLkWfMz true
  • Avira URL Cloud: safe
 unknown