Windows Analysis Report bhjRru88ej

Overview

General Information

Sample Name: bhjRru88ej (renamed file extension from none to exe)
Analysis ID: 532826
MD5: 3461688b684c14bfa1b81f1a110254e4
SHA1: 70269a15f2b27f2a3a33a4028d7aeb2e1094db58
SHA256: 5869ff09468b1aafa73c0a8fa15c953995495aa7144114003fdc4743860639ad
Tags: 32exetrojan
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Self deletion via cmd delete
Injects a PE file into a foreign processes
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Contains functionality to query CPU information (cpuid)
Found potential string decryption / allocating functions
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Creates a DirectInput object (often for capturing keystrokes)
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Contains capabilities to detect virtual machines
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.drmichaelirvine.com/yrcy/"], "decoy": ["ordermws-brands.com", "jkbswj.com", "dairatwsl.com", "lewismiddleton.com", "hevenorfeed.com", "kovogueshop.com", "cyberitconsultingz.com", "besrbee.com", "workerscompfl1.com", "wayfinderacu.com", "smplkindness.com", "servicesitcy.com", "babyvv.com", "fly-crypto.com", "chahuima.com", "trist-n.tech", "minjia56.com", "oded.top", "mes-dents-blanches.com", "nethunsleather.com", "onlinesindh.com", "genrage.com", "bhalawat.com", "5gwirelesszone.com", "semejnyjochag.com", "shopvintageallure.com", "laqueenbeautybar.supplies", "hominyprintingmuseum.com", "taksimbet13.com", "fairytalesinc.com", "loversscout.com", "nxn-n.com", "lovebydarius.store", "mintnft.tours", "snowjamproductiosmedia.com", "boraviajar.website", "cryptointelcenter.com", "m2momshealth.com", "perfectionbyinjection.com", "cletechsolutions.com", "skin4trade.com", "a9d7c19f0282.com", "waltersswholesale.com", "lendsoar.com", "virginialandsforsale.com", "shinepatio.com", "nba2klocker.team", "picturebookoriginals.com", "chatteusa.com", "bodevolidu.quest", "certidaoja.com", "scgxjp.com", "cbd-cannabis-store.com", "kadinisigi.com", "vacoveco.com", "hostedexchangemaintainces.com", "hf59184.com", "jingguanfm.com", "browsealto.com", "kymyra.com", "xrgoods.com", "dtsddcpj.com", "uptimisedmc.com", "redsigndesign.com"]}
Multi AV Scanner detection for submitted file
Source: bhjRru88ej.exe Virustotal: Detection: 18% Perma Link
Yara detected FormBook
Source: Yara match File source: 1.1.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bhjRru88ej.exe.25d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bhjRru88ej.exe.25d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413560341.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.384139517.00000000075EE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.397566356.00000000075EE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.353597466.00000000025D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413505967.00000000005C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.630654958.0000000002FB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413413880.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.350595433.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.352601050.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.351883848.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.630203304.0000000002EB0000.00000040.00020000.sdmp, type: MEMORY
Multi AV Scanner detection for domain / URL
Source: www.drmichaelirvine.com/yrcy/ Virustotal: Detection: 6% Perma Link
Antivirus or Machine Learning detection for unpacked file
Source: 20.0.explorer.exe.ba3796c.0.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.0.bhjRru88ej.exe.400000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.bhjRru88ej.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.0.bhjRru88ej.exe.400000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.1.bhjRru88ej.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.2.colorcpl.exe.539796c.4.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.0.bhjRru88ej.exe.400000.0.unpack Avira: Label: TR/Patched.Ren.Gen2
Source: 0.2.bhjRru88ej.exe.25d0000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.2.colorcpl.exe.ca3240.1.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 1.0.bhjRru88ej.exe.400000.3.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: bhjRru88ej.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: colorcpl.pdbGCTL source: bhjRru88ej.exe, 00000001.00000002.413982795.0000000002620000.00000040.00020000.sdmp
Source: Binary string: colorcpl.pdb source: bhjRru88ej.exe, 00000001.00000002.413982795.0000000002620000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: bhjRru88ej.exe, 00000000.00000003.351975445.0000000002A40000.00000004.00000001.sdmp, bhjRru88ej.exe, 00000000.00000003.348870904.0000000002BD0000.00000004.00000001.sdmp, bhjRru88ej.exe, 00000001.00000002.413692176.0000000000B1F000.00000040.00000001.sdmp, bhjRru88ej.exe, 00000001.00000002.413582954.0000000000A00000.00000040.00000001.sdmp, colorcpl.exe, 00000009.00000003.414557040.0000000004CC0000.00000004.00000001.sdmp, colorcpl.exe, 00000009.00000002.631312735.0000000004E60000.00000040.00000001.sdmp, colorcpl.exe, 00000009.00000002.631731697.0000000004F7F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: bhjRru88ej.exe, bhjRru88ej.exe, 00000001.00000002.413692176.0000000000B1F000.00000040.00000001.sdmp, bhjRru88ej.exe, 00000001.00000002.413582954.0000000000A00000.00000040.00000001.sdmp, colorcpl.exe, colorcpl.exe, 00000009.00000003.414557040.0000000004CC0000.00000004.00000001.sdmp, colorcpl.exe, 00000009.00000002.631312735.0000000004E60000.00000040.00000001.sdmp, colorcpl.exe, 00000009.00000002.631731697.0000000004F7F000.00000040.00000001.sdmp
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00405250 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405250
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00405C22 FindFirstFileA,FindClose, 0_2_00405C22
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00402630 FindFirstFileA, 0_2_00402630

Networking:

barindex
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.drmichaelirvine.com/yrcy/
Source: explorer.exe, 00000014.00000003.539787006.0000000008AB2000.00000004.00000001.sdmp, explorer.exe, 00000014.00000003.537714824.0000000008B04000.00000004.00000001.sdmp, explorer.exe, 00000014.00000003.539938122.0000000008ADA000.00000004.00000001.sdmp, explorer.exe, 00000014.00000003.539100134.0000000008A67000.00000004.00000001.sdmp, explorer.exe, 00000014.00000003.539419599.0000000008A67000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.c
Source: explorer.exe, 00000014.00000000.544421552.0000000008901000.00000004.00000001.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: explorer.exe, 00000014.00000003.537975097.0000000008A74000.00000004.00000001.sdmp, explorer.exe, 00000014.00000003.538324654.0000000008ADA000.00000004.00000001.sdmp String found in binary or memory: http://logo.verisign
Source: explorer.exe, 00000014.00000000.523416235.000000000347F000.00000004.00000001.sdmp String found in binary or memory: http://nsdobe.cM
Source: bhjRru88ej.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: bhjRru88ej.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000004.00000000.390882431.000000000095C000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.376768523.000000000095C000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.355838675.000000000095C000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.459181418.000000000095C000.00000004.00000020.sdmp String found in binary or memory: http://www.autoitscript.com/autoit3/J

Key, Mouse, Clipboard, Microphone and Screen Capturing:

barindex
Creates a DirectInput object (often for capturing keystrokes)
Source: bhjRru88ej.exe, 00000000.00000002.353234862.000000000078A000.00000004.00000020.sdmp Binary or memory string: <HOOK MODULE="DDRAW.DLL" FUNCTION="DirectDrawCreateEx"/>
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00404E07 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_00404E07

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 1.1.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bhjRru88ej.exe.25d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bhjRru88ej.exe.25d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413560341.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.384139517.00000000075EE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.397566356.00000000075EE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.353597466.00000000025D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413505967.00000000005C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.630654958.0000000002FB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413413880.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.350595433.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.352601050.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.351883848.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.630203304.0000000002EB0000.00000040.00020000.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 1.1.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.bhjRru88ej.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.bhjRru88ej.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.bhjRru88ej.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.bhjRru88ej.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.bhjRru88ej.exe.25d0000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.bhjRru88ej.exe.25d0000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.1.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.1.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.bhjRru88ej.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.bhjRru88ej.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.bhjRru88ej.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.bhjRru88ej.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0.2.bhjRru88ej.exe.25d0000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0.2.bhjRru88ej.exe.25d0000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.0.bhjRru88ej.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.0.bhjRru88ej.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.413560341.00000000009D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.413560341.00000000009D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.384139517.00000000075EE000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.384139517.00000000075EE000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000004.00000000.397566356.00000000075EE000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000004.00000000.397566356.00000000075EE000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.353597466.00000000025D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.353597466.00000000025D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.413505967.00000000005C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.413505967.00000000005C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.630654958.0000000002FB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.630654958.0000000002FB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.413413880.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.413413880.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.350595433.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.350595433.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000001.352601050.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000001.352601050.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000000.351883848.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000000.351883848.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.630203304.0000000002EB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.630203304.0000000002EB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: bhjRru88ej.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 1.1.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.bhjRru88ej.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.bhjRru88ej.exe.400000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.bhjRru88ej.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.bhjRru88ej.exe.400000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.bhjRru88ej.exe.25d0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.bhjRru88ej.exe.25d0000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.1.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.1.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.bhjRru88ej.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.bhjRru88ej.exe.400000.3.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.bhjRru88ej.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.bhjRru88ej.exe.400000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0.2.bhjRru88ej.exe.25d0000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0.2.bhjRru88ej.exe.25d0000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.0.bhjRru88ej.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.0.bhjRru88ej.exe.400000.3.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.413560341.00000000009D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.413560341.00000000009D0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.384139517.00000000075EE000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.384139517.00000000075EE000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000004.00000000.397566356.00000000075EE000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000004.00000000.397566356.00000000075EE000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.353597466.00000000025D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.353597466.00000000025D0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.413505967.00000000005C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.413505967.00000000005C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.630654958.0000000002FB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.630654958.0000000002FB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.413413880.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.413413880.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.350595433.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.350595433.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000001.352601050.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000001.352601050.0000000000400000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000000.351883848.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000000.351883848.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.630203304.0000000002EB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.630203304.0000000002EB0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_004030E3 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 0_2_004030E3
Detected potential crypto function
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00406043 0_2_00406043
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00404618 0_2_00404618
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_0040681A 0_2_0040681A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_10017011 0_2_10017011
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001F026 0_2_1001F026
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_100210E3 0_2_100210E3
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001FD40 0_2_1001FD40
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001C18E 0_2_1001C18E
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001F598 0_2_1001F598
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_10015E9B 0_2_10015E9B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001EAB4 0_2_1001EAB4
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001638F 0_2_1001638F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_100167A7 0_2_100167A7
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_10016BDC 0_2_10016BDC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00401030 1_2_00401030
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041C0E1 1_2_0041C0E1
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041C985 1_2_0041C985
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041BA8F 1_2_0041BA8F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041C37B 1_2_0041C37B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041CBED 1_2_0041CBED
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041C45D 1_2_0041C45D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00408C8B 1_2_00408C8B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00408C90 1_2_00408C90
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00402D88 1_2_00402D88
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00402D90 1_2_00402D90
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041C75C 1_2_0041C75C
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00402FB0 1_2_00402FB0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A520A0 1_2_00A520A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF20A8 1_2_00AF20A8
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3B090 1_2_00A3B090
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1002 1_2_00AE1002
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A44120 1_2_00A44120
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2F900 1_2_00A2F900
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF22AE 1_2_00AF22AE
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5EBB0 1_2_00A5EBB0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AEDBD2 1_2_00AEDBD2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF2B28 1_2_00AF2B28
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3841F 1_2_00A3841F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52581 1_2_00A52581
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3D5E0 1_2_00A3D5E0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A20D20 1_2_00A20D20
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF2D07 1_2_00AF2D07
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF1D55 1_2_00AF1D55
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF2EF7 1_2_00AF2EF7
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A46E30 1_2_00A46E30
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF1FF1 1_2_00AF1FF1
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_00401030 1_1_00401030
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041C0E1 1_1_0041C0E1
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041C985 1_1_0041C985
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041BA8F 1_1_0041BA8F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041C37B 1_1_0041C37B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041CBED 1_1_0041CBED
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041C45D 1_1_0041C45D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_00408C8B 1_1_00408C8B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_00408C90 1_1_00408C90
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_00402D88 1_1_00402D88
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_00402D90 1_1_00402D90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F528EC 9_2_04F528EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB20A0 9_2_04EB20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F520A8 9_2_04F520A8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9B090 9_2_04E9B090
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4D466 9_2_04F4D466
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41002 9_2_04F41002
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9841F 9_2_04E9841F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9D5E0 9_2_04E9D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F525DD 9_2_04F525DD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB2581 9_2_04EB2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F51D55 9_2_04F51D55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E80D20 9_2_04E80D20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA4120 9_2_04EA4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8F900 9_2_04E8F900
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F52D07 9_2_04F52D07
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F52EF7 9_2_04F52EF7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F522AE 9_2_04F522AE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA6E30 9_2_04EA6E30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F51FF1 9_2_04F51FF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4DBD2 9_2_04F4DBD2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBEBB0 9_2_04EBEBB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F52B28 9_2_04F52B28
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FCCBED 9_2_02FCCBED
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FCC0D9 9_2_02FCC0D9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FCC985 9_2_02FCC985
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FB2FB0 9_2_02FB2FB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FCC75C 9_2_02FCC75C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FB8C90 9_2_02FB8C90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FB8C8B 9_2_02FB8C8B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FCC45D 9_2_02FCC45D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FB2D90 9_2_02FB2D90
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FB2D88 9_2_02FB2D88
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: String function: 04E8B150 appears 35 times
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: String function: 0041A3A0 appears 36 times
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: String function: 00A2B150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_004185F0 NtCreateFile, 1_2_004185F0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_004186A0 NtReadFile, 1_2_004186A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00418720 NtClose, 1_2_00418720
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_004187D0 NtAllocateVirtualMemory, 1_2_004187D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_004185EE NtCreateFile, 1_2_004185EE
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041871C NtClose, 1_2_0041871C
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A698F0 NtReadVirtualMemory,LdrInitializeThunk, 1_2_00A698F0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69860 NtQuerySystemInformation,LdrInitializeThunk, 1_2_00A69860
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69840 NtDelayExecution,LdrInitializeThunk, 1_2_00A69840
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A699A0 NtCreateSection,LdrInitializeThunk, 1_2_00A699A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69910 NtAdjustPrivilegesToken,LdrInitializeThunk, 1_2_00A69910
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69A20 NtResumeThread,LdrInitializeThunk, 1_2_00A69A20
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69A00 NtProtectVirtualMemory,LdrInitializeThunk, 1_2_00A69A00
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69A50 NtCreateFile,LdrInitializeThunk, 1_2_00A69A50
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A695D0 NtClose,LdrInitializeThunk, 1_2_00A695D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69540 NtReadFile,LdrInitializeThunk, 1_2_00A69540
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A696E0 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_00A696E0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69660 NtAllocateVirtualMemory,LdrInitializeThunk, 1_2_00A69660
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A697A0 NtUnmapViewOfSection,LdrInitializeThunk, 1_2_00A697A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69780 NtMapViewOfSection,LdrInitializeThunk, 1_2_00A69780
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69FE0 NtCreateMutant,LdrInitializeThunk, 1_2_00A69FE0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69710 NtQueryInformationToken,LdrInitializeThunk, 1_2_00A69710
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A698A0 NtWriteVirtualMemory, 1_2_00A698A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69820 NtEnumerateKey, 1_2_00A69820
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A6B040 NtSuspendThread, 1_2_00A6B040
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A699D0 NtCreateProcessEx, 1_2_00A699D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69950 NtQueueApcThread, 1_2_00A69950
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69A80 NtOpenDirectoryObject, 1_2_00A69A80
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69A10 NtQuerySection, 1_2_00A69A10
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A6A3B0 NtGetContextThread, 1_2_00A6A3B0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69B00 NtSetValueKey, 1_2_00A69B00
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A695F0 NtQueryInformationFile, 1_2_00A695F0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69520 NtWaitForSingleObject, 1_2_00A69520
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A6AD30 NtSetContextThread, 1_2_00A6AD30
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69560 NtWriteFile, 1_2_00A69560
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A696D0 NtCreateKey, 1_2_00A696D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69610 NtEnumerateValueKey, 1_2_00A69610
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69670 NtQueryInformationProcess, 1_2_00A69670
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69650 NtQueryValueKey, 1_2_00A69650
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69730 NtQueryVirtualMemory, 1_2_00A69730
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A6A710 NtOpenProcessToken, 1_2_00A6A710
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69760 NtOpenProcess, 1_2_00A69760
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A69770 NtSetInformationFile, 1_2_00A69770
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A6A770 NtOpenThread, 1_2_00A6A770
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_004185F0 NtCreateFile, 1_1_004185F0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_004186A0 NtReadFile, 1_1_004186A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_00418720 NtClose, 1_1_00418720
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_004187D0 NtAllocateVirtualMemory, 1_1_004187D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_004185EE NtCreateFile, 1_1_004185EE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9860 NtQuerySystemInformation,LdrInitializeThunk, 9_2_04EC9860
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9840 NtDelayExecution,LdrInitializeThunk, 9_2_04EC9840
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC95D0 NtClose,LdrInitializeThunk, 9_2_04EC95D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC99A0 NtCreateSection,LdrInitializeThunk, 9_2_04EC99A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9540 NtReadFile,LdrInitializeThunk, 9_2_04EC9540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_04EC9910
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC96E0 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_04EC96E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC96D0 NtCreateKey,LdrInitializeThunk, 9_2_04EC96D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9660 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_04EC9660
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9650 NtQueryValueKey,LdrInitializeThunk, 9_2_04EC9650
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9A50 NtCreateFile,LdrInitializeThunk, 9_2_04EC9A50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9FE0 NtCreateMutant,LdrInitializeThunk, 9_2_04EC9FE0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9780 NtMapViewOfSection,LdrInitializeThunk, 9_2_04EC9780
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9710 NtQueryInformationToken,LdrInitializeThunk, 9_2_04EC9710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC98F0 NtReadVirtualMemory, 9_2_04EC98F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC98A0 NtWriteVirtualMemory, 9_2_04EC98A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04ECB040 NtSuspendThread, 9_2_04ECB040
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9820 NtEnumerateKey, 9_2_04EC9820
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC95F0 NtQueryInformationFile, 9_2_04EC95F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC99D0 NtCreateProcessEx, 9_2_04EC99D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9560 NtWriteFile, 9_2_04EC9560
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9950 NtQueueApcThread, 9_2_04EC9950
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9520 NtWaitForSingleObject, 9_2_04EC9520
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04ECAD30 NtSetContextThread, 9_2_04ECAD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9A80 NtOpenDirectoryObject, 9_2_04EC9A80
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9670 NtQueryInformationProcess, 9_2_04EC9670
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9A20 NtResumeThread, 9_2_04EC9A20
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9A00 NtProtectVirtualMemory, 9_2_04EC9A00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9610 NtEnumerateValueKey, 9_2_04EC9610
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9A10 NtQuerySection, 9_2_04EC9A10
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC97A0 NtUnmapViewOfSection, 9_2_04EC97A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04ECA3B0 NtGetContextThread, 9_2_04ECA3B0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9760 NtOpenProcess, 9_2_04EC9760
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9770 NtSetInformationFile, 9_2_04EC9770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04ECA770 NtOpenThread, 9_2_04ECA770
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9730 NtQueryVirtualMemory, 9_2_04EC9730
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC9B00 NtSetValueKey, 9_2_04EC9B00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04ECA710 NtOpenProcessToken, 9_2_04ECA710
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FC86A0 NtReadFile, 9_2_02FC86A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FC87D0 NtAllocateVirtualMemory, 9_2_02FC87D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FC8720 NtClose, 9_2_02FC8720
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FC85F0 NtCreateFile, 9_2_02FC85F0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FC871C NtClose, 9_2_02FC871C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FC85EE NtCreateFile, 9_2_02FC85EE
Sample file is different than original file name gathered from version info
Source: bhjRru88ej.exe, 00000000.00000003.352137303.0000000002B56000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs bhjRru88ej.exe
Source: bhjRru88ej.exe, 00000000.00000003.350119568.0000000002CEF000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs bhjRru88ej.exe
Source: bhjRru88ej.exe, 00000001.00000002.413841134.0000000000CAF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs bhjRru88ej.exe
Source: bhjRru88ej.exe, 00000001.00000002.413692176.0000000000B1F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs bhjRru88ej.exe
Source: bhjRru88ej.exe, 00000001.00000002.413989147.0000000002623000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamecolorcpl.exej% vs bhjRru88ej.exe
Source: bhjRru88ej.exe Virustotal: Detection: 18%
Source: C:\Users\user\Desktop\bhjRru88ej.exe File read: C:\Users\user\Desktop\bhjRru88ej.exe Jump to behavior
Source: bhjRru88ej.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\bhjRru88ej.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\bhjRru88ej.exe "C:\Users\user\Desktop\bhjRru88ej.exe"
Source: C:\Users\user\Desktop\bhjRru88ej.exe Process created: C:\Users\user\Desktop\bhjRru88ej.exe "C:\Users\user\Desktop\bhjRru88ej.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\colorcpl.exe C:\Windows\SysWOW64\colorcpl.exe
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\bhjRru88ej.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\explorer.exe "C:\Windows\explorer.exe" /LOADSAVEDWINDOWS
Source: C:\Users\user\Desktop\bhjRru88ej.exe Process created: C:\Users\user\Desktop\bhjRru88ej.exe "C:\Users\user\Desktop\bhjRru88ej.exe" Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\bhjRru88ej.exe" Jump to behavior
Source: C:\Users\user\Desktop\bhjRru88ej.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Windows\explorer.exe File created: C:\Users\user\AppData\Local\Microsoft\Windows\Caches\{3DA71D5A-20CC-432F-A115-DFE92379E91F}.3.ver0x0000000000000015.db Jump to behavior
Source: C:\Users\user\Desktop\bhjRru88ej.exe File created: C:\Users\user\AppData\Local\Temp\nscC64C.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@8/2@0/0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00402012 CoCreateInstance,MultiByteToWideChar, 0_2_00402012
Source: C:\Users\user\Desktop\bhjRru88ej.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_0040411B GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 0_2_0040411B
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\explorer.exe
Source: Window Recorder Window detected: More than 3 window changes detected
Source: Binary string: colorcpl.pdbGCTL source: bhjRru88ej.exe, 00000001.00000002.413982795.0000000002620000.00000040.00020000.sdmp
Source: Binary string: colorcpl.pdb source: bhjRru88ej.exe, 00000001.00000002.413982795.0000000002620000.00000040.00020000.sdmp
Source: Binary string: wntdll.pdbUGP source: bhjRru88ej.exe, 00000000.00000003.351975445.0000000002A40000.00000004.00000001.sdmp, bhjRru88ej.exe, 00000000.00000003.348870904.0000000002BD0000.00000004.00000001.sdmp, bhjRru88ej.exe, 00000001.00000002.413692176.0000000000B1F000.00000040.00000001.sdmp, bhjRru88ej.exe, 00000001.00000002.413582954.0000000000A00000.00000040.00000001.sdmp, colorcpl.exe, 00000009.00000003.414557040.0000000004CC0000.00000004.00000001.sdmp, colorcpl.exe, 00000009.00000002.631312735.0000000004E60000.00000040.00000001.sdmp, colorcpl.exe, 00000009.00000002.631731697.0000000004F7F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: bhjRru88ej.exe, bhjRru88ej.exe, 00000001.00000002.413692176.0000000000B1F000.00000040.00000001.sdmp, bhjRru88ej.exe, 00000001.00000002.413582954.0000000000A00000.00000040.00000001.sdmp, colorcpl.exe, colorcpl.exe, 00000009.00000003.414557040.0000000004CC0000.00000004.00000001.sdmp, colorcpl.exe, 00000009.00000002.631312735.0000000004E60000.00000040.00000001.sdmp, colorcpl.exe, 00000009.00000002.631731697.0000000004F7F000.00000040.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001B185 push ecx; ret 0_2_1001B198
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041B832 push eax; ret 1_2_0041B838
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041B83B push eax; ret 1_2_0041B8A2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041B8C9 push eax; ret 1_2_0041B8A2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041B8C9 push eax; ret 1_2_0041B8A2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041B89C push eax; ret 1_2_0041B8A2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041A14C push edx; iretd 1_2_0041A14D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041A9F5 push ss; retf 1_2_0041A9F6
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041C985 push 2E33947Ah; ret 1_2_0041CBEC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041526B push es; retf 1_2_00415281
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0040C30E pushad ; iretd 1_2_0040C30F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041CBED push 2E33947Ah; ret 1_2_0041CBEC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041D466 push 80958155h; iretd 1_2_0041D477
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00415C32 push ecx; ret 1_2_00415C33
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_0041B7E5 push eax; ret 1_2_0041B838
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A7D0D1 push ecx; ret 1_2_00A7D0E4
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041B832 push eax; ret 1_1_0041B838
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041B83B push eax; ret 1_1_0041B8A2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041B8C9 push eax; ret 1_1_0041B8A2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041B8C9 push eax; ret 1_1_0041B8A2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041B89C push eax; ret 1_1_0041B8A2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041A14C push edx; iretd 1_1_0041A14D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041A9F5 push ss; retf 1_1_0041A9F6
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041C985 push 2E33947Ah; ret 1_1_0041CBEC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041526B push es; retf 1_1_00415281
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0040C30E pushad ; iretd 1_1_0040C30F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041CBED push 2E33947Ah; ret 1_1_0041CBEC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_0041D466 push 80958155h; iretd 1_1_0041D477
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_1_00415C32 push ecx; ret 1_1_00415C33
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EDD0D1 push ecx; ret 9_2_04EDD0E4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_02FC526B push es; retf 9_2_02FC5281
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00405C49 GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405C49

Persistence and Installation Behavior:

barindex
Drops PE files
Source: C:\Users\user\Desktop\bhjRru88ej.exe File created: C:\Users\user\AppData\Local\Temp\nsnC68C.tmp\kxovistzen.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection:

barindex
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: /c del "C:\Users\user\Desktop\bhjRru88ej.exe"
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: /c del "C:\Users\user\Desktop\bhjRru88ej.exe" Jump to behavior
Monitors certain registry keys / values for changes (often done to protect autostart functionality)
Source: C:\Windows\explorer.exe Registry key monitored for changes: HKEY_CURRENT_USER_Classes Jump to behavior
Source: C:\Users\user\Desktop\bhjRru88ej.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\bhjRru88ej.exe RDTSC instruction interceptor: First address: 0000000000408614 second address: 000000000040861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\bhjRru88ej.exe RDTSC instruction interceptor: First address: 00000000004089AE second address: 00000000004089B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000002FB8614 second address: 0000000002FB861A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\colorcpl.exe RDTSC instruction interceptor: First address: 0000000002FB89AE second address: 0000000002FB89B4 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_004088E0 rdtsc 1_2_004088E0
Contains capabilities to detect virtual machines
Source: C:\Windows\explorer.exe File opened / queried: SCSI#Disk&Ven_VMware&Prod_Virtual_disk#5&1ec51bf7&0&000000#{53f56307-b6bf-11d0-94f2-00a0c91efb8b} Jump to behavior
Source: C:\Users\user\Desktop\bhjRru88ej.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00405250 DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 0_2_00405250
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00405C22 FindFirstFileA,FindClose, 0_2_00405C22
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00402630 FindFirstFileA, 0_2_00402630
Source: explorer.exe, 00000004.00000000.367808794.00000000083E9000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00dRom0
Source: explorer.exe, 00000014.00000000.544421552.0000000008901000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000014.00000000.537491509.0000000005390000.00000004.00000001.sdmp Binary or memory string: k\\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}`t
Source: explorer.exe, 00000014.00000003.520182409.0000000004DC3000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000014.00000003.576819870.0000000008A13000.00000004.00000001.sdmp Binary or memory string: \REGISTRY\USER\S-1-5-21-3853321935-2125563209-4053062332-1002_Classes\CLSID\{116F8D13-101E-4fa5-84D4-FF8279381935}\InProcServer32olume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 00000014.00000003.545753517.0000000008A18000.00000004.00000001.sdmp Binary or memory string: 8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 00000004.00000000.358736890.00000000062E0000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000014.00000003.565224749.0000000008B60000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B-
Source: explorer.exe, 00000014.00000003.543458265.0000000008B24000.00000004.00000001.sdmp Binary or memory string: -1-5-21-3853321935-2125563209-4053062332-1002_Classes\CLSID\{1A1F4206-0688-4E7F-BE03-D82EC69DF9A5}\InprocHandler320000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f-
Source: explorer.exe, 00000014.00000003.542471214.0000000008A10000.00000004.00000001.sdmp Binary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&VY
Source: explorer.exe, 00000014.00000003.566270874.0000000010CF8000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000014.00000003.539419599.0000000008A67000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000014.00000003.544656638.0000000008B27000.00000004.00000001.sdmp Binary or memory string: dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}L=6PROCESSOR_REVISION=5507BY
Source: explorer.exe, 00000014.00000003.576819870.0000000008A13000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}wsApps3
Source: explorer.exe, 00000014.00000000.545321927.0000000008B27000.00000004.00000001.sdmp Binary or memory string: 53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}L=6PROCESSOR_REVISION=5507BY
Source: explorer.exe, 00000014.00000003.544656638.0000000008B27000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Users
Source: explorer.exe, 00000014.00000003.576819870.0000000008A13000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}ws
Source: explorer.exe, 00000014.00000000.584357358.0000000001397000.00000004.00000020.sdmp Binary or memory string: ECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&00
Source: explorer.exe, 00000014.00000003.520182409.0000000004DC3000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}>\
Source: explorer.exe, 00000014.00000003.572882229.0000000008B15000.00000004.00000001.sdmp Binary or memory string: #CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&
Source: explorer.exe, 00000014.00000003.576819870.0000000008A13000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}dulePat
Source: bhjRru88ej.exe, 00000000.00000002.353234862.000000000078A000.00000004.00000020.sdmp Binary or memory string: zSCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\Device\CdRom0\??\Volume{e6e9dfd8-98f2-11e9-90ce-806e6f6e6963}\DosDevices\D:Qcpp
Source: explorer.exe, 00000014.00000000.544732982.00000000089CF000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000014.00000003.535114938.00000000089D2000.00000004.00000001.sdmp Binary or memory string: ;;SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000004.00000000.367808794.00000000083E9000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000014.00000003.572882229.0000000008B15000.00000004.00000001.sdmp Binary or memory string: ar&_VMware_SATA_CD00#5&280b
Source: explorer.exe, 00000014.00000003.562081902.000000001115E000.00000004.00000001.sdmp Binary or memory string: -98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B:
Source: explorer.exe, 00000004.00000000.367696418.00000000082E2000.00000004.00000001.sdmp Binary or memory string: AGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}Y
Source: explorer.exe, 00000014.00000000.544732982.00000000089CF000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00IC
Source: explorer.exe, 00000014.00000003.535114938.00000000089D2000.00000004.00000001.sdmp Binary or memory string: AASCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000014.00000003.562081902.000000001115E000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}BO
Source: explorer.exe, 00000014.00000003.576819870.0000000008A13000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}O
Source: explorer.exe, 00000004.00000000.367696418.00000000082E2000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}>
Source: explorer.exe, 00000014.00000000.544732982.00000000089CF000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}er.Hu
Source: explorer.exe, 00000014.00000000.560009880.000000001115C000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B:
Source: explorer.exe, 00000014.00000000.544624794.00000000089A2000.00000004.00000001.sdmp Binary or memory string: VMware SATA CD00ngs
Source: explorer.exe, 00000014.00000003.572882229.0000000008B15000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA(
Source: explorer.exe, 00000014.00000003.542471214.0000000008A10000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B
Source: explorer.exe, 00000014.00000000.588943412.0000000004D82000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: explorer.exe, 00000004.00000000.385442909.0000000008430000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000-;
Source: explorer.exe, 00000004.00000000.459181418.000000000095C000.00000004.00000020.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}G
Source: explorer.exe, 00000014.00000003.562081902.000000001115E000.00000004.00000001.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}B@

Anti Debugging:

barindex
Contains functionality to check if a debugger is running (IsDebuggerPresent)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001B9E7 IsDebuggerPresent, 0_2_1001B9E7
Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_10019B8A EncodePointer,EncodePointer,___crtIsPackagedApp,LoadLibraryExW,GetLastError,LoadLibraryExW,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,GetProcAddress,EncodePointer,IsDebuggerPresent,OutputDebugStringW,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer,DecodePointer, 0_2_10019B8A
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_00405C49 GetModuleHandleA,LoadLibraryA,GetProcAddress, 0_2_00405C49
Contains functionality which may be used to detect a debugger (GetProcessHeap)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_10007CE0 SetEnhMetaFileBits,SetWinMetaFileBits,GetDC,CreateDIBitmap,ReleaseDC,GetProcessHeap,HeapFree, 0_2_10007CE0
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_004088E0 rdtsc 1_2_004088E0
Enables debug privileges
Source: C:\Users\user\Desktop\bhjRru88ej.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_0019EC20 mov eax, dword ptr fs:[00000030h] 0_2_0019EC20
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_0019E8DE mov eax, dword ptr fs:[00000030h] 0_2_0019E8DE
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_0019EAF2 mov eax, dword ptr fs:[00000030h] 0_2_0019EAF2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_0019EBA3 mov eax, dword ptr fs:[00000030h] 0_2_0019EBA3
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_0019EBE2 mov eax, dword ptr fs:[00000030h] 0_2_0019EBE2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A520A0 mov eax, dword ptr fs:[00000030h] 1_2_00A520A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A520A0 mov eax, dword ptr fs:[00000030h] 1_2_00A520A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A520A0 mov eax, dword ptr fs:[00000030h] 1_2_00A520A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A520A0 mov eax, dword ptr fs:[00000030h] 1_2_00A520A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A520A0 mov eax, dword ptr fs:[00000030h] 1_2_00A520A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A520A0 mov eax, dword ptr fs:[00000030h] 1_2_00A520A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A690AF mov eax, dword ptr fs:[00000030h] 1_2_00A690AF
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5F0BF mov ecx, dword ptr fs:[00000030h] 1_2_00A5F0BF
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5F0BF mov eax, dword ptr fs:[00000030h] 1_2_00A5F0BF
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5F0BF mov eax, dword ptr fs:[00000030h] 1_2_00A5F0BF
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A29080 mov eax, dword ptr fs:[00000030h] 1_2_00A29080
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA3884 mov eax, dword ptr fs:[00000030h] 1_2_00AA3884
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA3884 mov eax, dword ptr fs:[00000030h] 1_2_00AA3884
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A258EC mov eax, dword ptr fs:[00000030h] 1_2_00A258EC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ABB8D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABB8D0 mov ecx, dword ptr fs:[00000030h] 1_2_00ABB8D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ABB8D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ABB8D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ABB8D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABB8D0 mov eax, dword ptr fs:[00000030h] 1_2_00ABB8D0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5002D mov eax, dword ptr fs:[00000030h] 1_2_00A5002D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5002D mov eax, dword ptr fs:[00000030h] 1_2_00A5002D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5002D mov eax, dword ptr fs:[00000030h] 1_2_00A5002D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5002D mov eax, dword ptr fs:[00000030h] 1_2_00A5002D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5002D mov eax, dword ptr fs:[00000030h] 1_2_00A5002D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3B02A mov eax, dword ptr fs:[00000030h] 1_2_00A3B02A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3B02A mov eax, dword ptr fs:[00000030h] 1_2_00A3B02A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3B02A mov eax, dword ptr fs:[00000030h] 1_2_00A3B02A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3B02A mov eax, dword ptr fs:[00000030h] 1_2_00A3B02A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF4015 mov eax, dword ptr fs:[00000030h] 1_2_00AF4015
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF4015 mov eax, dword ptr fs:[00000030h] 1_2_00AF4015
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA7016 mov eax, dword ptr fs:[00000030h] 1_2_00AA7016
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA7016 mov eax, dword ptr fs:[00000030h] 1_2_00AA7016
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA7016 mov eax, dword ptr fs:[00000030h] 1_2_00AA7016
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF1074 mov eax, dword ptr fs:[00000030h] 1_2_00AF1074
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE2073 mov eax, dword ptr fs:[00000030h] 1_2_00AE2073
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A40050 mov eax, dword ptr fs:[00000030h] 1_2_00A40050
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A40050 mov eax, dword ptr fs:[00000030h] 1_2_00A40050
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A561A0 mov eax, dword ptr fs:[00000030h] 1_2_00A561A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A561A0 mov eax, dword ptr fs:[00000030h] 1_2_00A561A0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA69A6 mov eax, dword ptr fs:[00000030h] 1_2_00AA69A6
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA51BE mov eax, dword ptr fs:[00000030h] 1_2_00AA51BE
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA51BE mov eax, dword ptr fs:[00000030h] 1_2_00AA51BE
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA51BE mov eax, dword ptr fs:[00000030h] 1_2_00AA51BE
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA51BE mov eax, dword ptr fs:[00000030h] 1_2_00AA51BE
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5A185 mov eax, dword ptr fs:[00000030h] 1_2_00A5A185
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4C182 mov eax, dword ptr fs:[00000030h] 1_2_00A4C182
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52990 mov eax, dword ptr fs:[00000030h] 1_2_00A52990
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A2B1E1
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A2B1E1
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2B1E1 mov eax, dword ptr fs:[00000030h] 1_2_00A2B1E1
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AB41E8 mov eax, dword ptr fs:[00000030h] 1_2_00AB41E8
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A44120 mov eax, dword ptr fs:[00000030h] 1_2_00A44120
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A44120 mov eax, dword ptr fs:[00000030h] 1_2_00A44120
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A44120 mov eax, dword ptr fs:[00000030h] 1_2_00A44120
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A44120 mov eax, dword ptr fs:[00000030h] 1_2_00A44120
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A44120 mov ecx, dword ptr fs:[00000030h] 1_2_00A44120
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5513A mov eax, dword ptr fs:[00000030h] 1_2_00A5513A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5513A mov eax, dword ptr fs:[00000030h] 1_2_00A5513A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A29100 mov eax, dword ptr fs:[00000030h] 1_2_00A29100
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A29100 mov eax, dword ptr fs:[00000030h] 1_2_00A29100
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A29100 mov eax, dword ptr fs:[00000030h] 1_2_00A29100
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2C962 mov eax, dword ptr fs:[00000030h] 1_2_00A2C962
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2B171 mov eax, dword ptr fs:[00000030h] 1_2_00A2B171
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2B171 mov eax, dword ptr fs:[00000030h] 1_2_00A2B171
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4B944 mov eax, dword ptr fs:[00000030h] 1_2_00A4B944
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4B944 mov eax, dword ptr fs:[00000030h] 1_2_00A4B944
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A252A5 mov eax, dword ptr fs:[00000030h] 1_2_00A252A5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A252A5 mov eax, dword ptr fs:[00000030h] 1_2_00A252A5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A252A5 mov eax, dword ptr fs:[00000030h] 1_2_00A252A5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A252A5 mov eax, dword ptr fs:[00000030h] 1_2_00A252A5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A252A5 mov eax, dword ptr fs:[00000030h] 1_2_00A252A5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3AAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A3AAB0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3AAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A3AAB0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5FAB0 mov eax, dword ptr fs:[00000030h] 1_2_00A5FAB0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5D294 mov eax, dword ptr fs:[00000030h] 1_2_00A5D294
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5D294 mov eax, dword ptr fs:[00000030h] 1_2_00A5D294
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52AE4 mov eax, dword ptr fs:[00000030h] 1_2_00A52AE4
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52ACB mov eax, dword ptr fs:[00000030h] 1_2_00A52ACB
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A64A2C mov eax, dword ptr fs:[00000030h] 1_2_00A64A2C
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A64A2C mov eax, dword ptr fs:[00000030h] 1_2_00A64A2C
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A38A0A mov eax, dword ptr fs:[00000030h] 1_2_00A38A0A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A25210 mov eax, dword ptr fs:[00000030h] 1_2_00A25210
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A25210 mov ecx, dword ptr fs:[00000030h] 1_2_00A25210
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A25210 mov eax, dword ptr fs:[00000030h] 1_2_00A25210
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A25210 mov eax, dword ptr fs:[00000030h] 1_2_00A25210
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2AA16 mov eax, dword ptr fs:[00000030h] 1_2_00A2AA16
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2AA16 mov eax, dword ptr fs:[00000030h] 1_2_00A2AA16
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A43A1C mov eax, dword ptr fs:[00000030h] 1_2_00A43A1C
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ADB260 mov eax, dword ptr fs:[00000030h] 1_2_00ADB260
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ADB260 mov eax, dword ptr fs:[00000030h] 1_2_00ADB260
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF8A62 mov eax, dword ptr fs:[00000030h] 1_2_00AF8A62
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A6927A mov eax, dword ptr fs:[00000030h] 1_2_00A6927A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A29240 mov eax, dword ptr fs:[00000030h] 1_2_00A29240
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A29240 mov eax, dword ptr fs:[00000030h] 1_2_00A29240
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A29240 mov eax, dword ptr fs:[00000030h] 1_2_00A29240
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A29240 mov eax, dword ptr fs:[00000030h] 1_2_00A29240
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AB4257 mov eax, dword ptr fs:[00000030h] 1_2_00AB4257
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A54BAD mov eax, dword ptr fs:[00000030h] 1_2_00A54BAD
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A54BAD mov eax, dword ptr fs:[00000030h] 1_2_00A54BAD
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A54BAD mov eax, dword ptr fs:[00000030h] 1_2_00A54BAD
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF5BA5 mov eax, dword ptr fs:[00000030h] 1_2_00AF5BA5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE138A mov eax, dword ptr fs:[00000030h] 1_2_00AE138A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A31B8F mov eax, dword ptr fs:[00000030h] 1_2_00A31B8F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A31B8F mov eax, dword ptr fs:[00000030h] 1_2_00A31B8F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ADD380 mov ecx, dword ptr fs:[00000030h] 1_2_00ADD380
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52397 mov eax, dword ptr fs:[00000030h] 1_2_00A52397
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5B390 mov eax, dword ptr fs:[00000030h] 1_2_00A5B390
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A503E2 mov eax, dword ptr fs:[00000030h] 1_2_00A503E2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A503E2 mov eax, dword ptr fs:[00000030h] 1_2_00A503E2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A503E2 mov eax, dword ptr fs:[00000030h] 1_2_00A503E2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A503E2 mov eax, dword ptr fs:[00000030h] 1_2_00A503E2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A503E2 mov eax, dword ptr fs:[00000030h] 1_2_00A503E2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A503E2 mov eax, dword ptr fs:[00000030h] 1_2_00A503E2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4DBE9 mov eax, dword ptr fs:[00000030h] 1_2_00A4DBE9
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA53CA mov eax, dword ptr fs:[00000030h] 1_2_00AA53CA
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA53CA mov eax, dword ptr fs:[00000030h] 1_2_00AA53CA
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE131B mov eax, dword ptr fs:[00000030h] 1_2_00AE131B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2DB60 mov ecx, dword ptr fs:[00000030h] 1_2_00A2DB60
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A53B7A mov eax, dword ptr fs:[00000030h] 1_2_00A53B7A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A53B7A mov eax, dword ptr fs:[00000030h] 1_2_00A53B7A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2DB40 mov eax, dword ptr fs:[00000030h] 1_2_00A2DB40
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF8B58 mov eax, dword ptr fs:[00000030h] 1_2_00AF8B58
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2F358 mov eax, dword ptr fs:[00000030h] 1_2_00A2F358
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3849B mov eax, dword ptr fs:[00000030h] 1_2_00A3849B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE14FB mov eax, dword ptr fs:[00000030h] 1_2_00AE14FB
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00AA6CF0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00AA6CF0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6CF0 mov eax, dword ptr fs:[00000030h] 1_2_00AA6CF0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF8CD6 mov eax, dword ptr fs:[00000030h] 1_2_00AF8CD6
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5BC2C mov eax, dword ptr fs:[00000030h] 1_2_00A5BC2C
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6C0A mov eax, dword ptr fs:[00000030h] 1_2_00AA6C0A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6C0A mov eax, dword ptr fs:[00000030h] 1_2_00AA6C0A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6C0A mov eax, dword ptr fs:[00000030h] 1_2_00AA6C0A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6C0A mov eax, dword ptr fs:[00000030h] 1_2_00AA6C0A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF740D mov eax, dword ptr fs:[00000030h] 1_2_00AF740D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF740D mov eax, dword ptr fs:[00000030h] 1_2_00AF740D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF740D mov eax, dword ptr fs:[00000030h] 1_2_00AF740D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1C06 mov eax, dword ptr fs:[00000030h] 1_2_00AE1C06
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4746D mov eax, dword ptr fs:[00000030h] 1_2_00A4746D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5A44B mov eax, dword ptr fs:[00000030h] 1_2_00A5A44B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABC450 mov eax, dword ptr fs:[00000030h] 1_2_00ABC450
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABC450 mov eax, dword ptr fs:[00000030h] 1_2_00ABC450
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF05AC mov eax, dword ptr fs:[00000030h] 1_2_00AF05AC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF05AC mov eax, dword ptr fs:[00000030h] 1_2_00AF05AC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A535A1 mov eax, dword ptr fs:[00000030h] 1_2_00A535A1
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A51DB5 mov eax, dword ptr fs:[00000030h] 1_2_00A51DB5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A51DB5 mov eax, dword ptr fs:[00000030h] 1_2_00A51DB5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A51DB5 mov eax, dword ptr fs:[00000030h] 1_2_00A51DB5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52581 mov eax, dword ptr fs:[00000030h] 1_2_00A52581
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52581 mov eax, dword ptr fs:[00000030h] 1_2_00A52581
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52581 mov eax, dword ptr fs:[00000030h] 1_2_00A52581
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A52581 mov eax, dword ptr fs:[00000030h] 1_2_00A52581
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A22D8A mov eax, dword ptr fs:[00000030h] 1_2_00A22D8A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A22D8A mov eax, dword ptr fs:[00000030h] 1_2_00A22D8A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A22D8A mov eax, dword ptr fs:[00000030h] 1_2_00A22D8A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A22D8A mov eax, dword ptr fs:[00000030h] 1_2_00A22D8A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A22D8A mov eax, dword ptr fs:[00000030h] 1_2_00A22D8A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5FD9B mov eax, dword ptr fs:[00000030h] 1_2_00A5FD9B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5FD9B mov eax, dword ptr fs:[00000030h] 1_2_00A5FD9B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3D5E0 mov eax, dword ptr fs:[00000030h] 1_2_00A3D5E0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3D5E0 mov eax, dword ptr fs:[00000030h] 1_2_00A3D5E0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AEFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00AEFDE2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AEFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00AEFDE2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AEFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00AEFDE2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AEFDE2 mov eax, dword ptr fs:[00000030h] 1_2_00AEFDE2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AD8DF1 mov eax, dword ptr fs:[00000030h] 1_2_00AD8DF1
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AA6DC9
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AA6DC9
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AA6DC9
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6DC9 mov ecx, dword ptr fs:[00000030h] 1_2_00AA6DC9
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AA6DC9
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA6DC9 mov eax, dword ptr fs:[00000030h] 1_2_00AA6DC9
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2AD30 mov eax, dword ptr fs:[00000030h] 1_2_00A2AD30
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A33D34 mov eax, dword ptr fs:[00000030h] 1_2_00A33D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF8D34 mov eax, dword ptr fs:[00000030h] 1_2_00AF8D34
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AAA537 mov eax, dword ptr fs:[00000030h] 1_2_00AAA537
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A54D3B mov eax, dword ptr fs:[00000030h] 1_2_00A54D3B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A54D3B mov eax, dword ptr fs:[00000030h] 1_2_00A54D3B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A54D3B mov eax, dword ptr fs:[00000030h] 1_2_00A54D3B
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4C577 mov eax, dword ptr fs:[00000030h] 1_2_00A4C577
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4C577 mov eax, dword ptr fs:[00000030h] 1_2_00A4C577
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A63D43 mov eax, dword ptr fs:[00000030h] 1_2_00A63D43
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA3540 mov eax, dword ptr fs:[00000030h] 1_2_00AA3540
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A47D50 mov eax, dword ptr fs:[00000030h] 1_2_00A47D50
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF0EA5 mov eax, dword ptr fs:[00000030h] 1_2_00AF0EA5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF0EA5 mov eax, dword ptr fs:[00000030h] 1_2_00AF0EA5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF0EA5 mov eax, dword ptr fs:[00000030h] 1_2_00AF0EA5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA46A7 mov eax, dword ptr fs:[00000030h] 1_2_00AA46A7
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABFE87 mov eax, dword ptr fs:[00000030h] 1_2_00ABFE87
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A376E2 mov eax, dword ptr fs:[00000030h] 1_2_00A376E2
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A516E0 mov ecx, dword ptr fs:[00000030h] 1_2_00A516E0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A68EC7 mov eax, dword ptr fs:[00000030h] 1_2_00A68EC7
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A536CC mov eax, dword ptr fs:[00000030h] 1_2_00A536CC
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ADFEC0 mov eax, dword ptr fs:[00000030h] 1_2_00ADFEC0
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF8ED6 mov eax, dword ptr fs:[00000030h] 1_2_00AF8ED6
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2E620 mov eax, dword ptr fs:[00000030h] 1_2_00A2E620
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ADFE3F mov eax, dword ptr fs:[00000030h] 1_2_00ADFE3F
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2C600 mov eax, dword ptr fs:[00000030h] 1_2_00A2C600
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2C600 mov eax, dword ptr fs:[00000030h] 1_2_00A2C600
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A2C600 mov eax, dword ptr fs:[00000030h] 1_2_00A2C600
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A58E00 mov eax, dword ptr fs:[00000030h] 1_2_00A58E00
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AE1608 mov eax, dword ptr fs:[00000030h] 1_2_00AE1608
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5A61C mov eax, dword ptr fs:[00000030h] 1_2_00A5A61C
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5A61C mov eax, dword ptr fs:[00000030h] 1_2_00A5A61C
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3766D mov eax, dword ptr fs:[00000030h] 1_2_00A3766D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A4AE73
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A4AE73
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A4AE73
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A4AE73
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4AE73 mov eax, dword ptr fs:[00000030h] 1_2_00A4AE73
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A37E41 mov eax, dword ptr fs:[00000030h] 1_2_00A37E41
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A37E41 mov eax, dword ptr fs:[00000030h] 1_2_00A37E41
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A37E41 mov eax, dword ptr fs:[00000030h] 1_2_00A37E41
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A37E41 mov eax, dword ptr fs:[00000030h] 1_2_00A37E41
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A37E41 mov eax, dword ptr fs:[00000030h] 1_2_00A37E41
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A37E41 mov eax, dword ptr fs:[00000030h] 1_2_00A37E41
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A38794 mov eax, dword ptr fs:[00000030h] 1_2_00A38794
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA7794 mov eax, dword ptr fs:[00000030h] 1_2_00AA7794
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA7794 mov eax, dword ptr fs:[00000030h] 1_2_00AA7794
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AA7794 mov eax, dword ptr fs:[00000030h] 1_2_00AA7794
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A637F5 mov eax, dword ptr fs:[00000030h] 1_2_00A637F5
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A24F2E mov eax, dword ptr fs:[00000030h] 1_2_00A24F2E
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A24F2E mov eax, dword ptr fs:[00000030h] 1_2_00A24F2E
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5E730 mov eax, dword ptr fs:[00000030h] 1_2_00A5E730
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF070D mov eax, dword ptr fs:[00000030h] 1_2_00AF070D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF070D mov eax, dword ptr fs:[00000030h] 1_2_00AF070D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5A70E mov eax, dword ptr fs:[00000030h] 1_2_00A5A70E
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A5A70E mov eax, dword ptr fs:[00000030h] 1_2_00A5A70E
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A4F716 mov eax, dword ptr fs:[00000030h] 1_2_00A4F716
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABFF10 mov eax, dword ptr fs:[00000030h] 1_2_00ABFF10
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00ABFF10 mov eax, dword ptr fs:[00000030h] 1_2_00ABFF10
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3FF60 mov eax, dword ptr fs:[00000030h] 1_2_00A3FF60
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00AF8F6A mov eax, dword ptr fs:[00000030h] 1_2_00AF8F6A
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00A3EF40 mov eax, dword ptr fs:[00000030h] 1_2_00A3EF40
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06CF0 mov eax, dword ptr fs:[00000030h] 9_2_04F06CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06CF0 mov eax, dword ptr fs:[00000030h] 9_2_04F06CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06CF0 mov eax, dword ptr fs:[00000030h] 9_2_04F06CF0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E858EC mov eax, dword ptr fs:[00000030h] 9_2_04E858EC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F414FB mov eax, dword ptr fs:[00000030h] 9_2_04F414FB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1B8D0 mov eax, dword ptr fs:[00000030h] 9_2_04F1B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1B8D0 mov ecx, dword ptr fs:[00000030h] 9_2_04F1B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1B8D0 mov eax, dword ptr fs:[00000030h] 9_2_04F1B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1B8D0 mov eax, dword ptr fs:[00000030h] 9_2_04F1B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1B8D0 mov eax, dword ptr fs:[00000030h] 9_2_04F1B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1B8D0 mov eax, dword ptr fs:[00000030h] 9_2_04F1B8D0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F58CD6 mov eax, dword ptr fs:[00000030h] 9_2_04F58CD6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC90AF mov eax, dword ptr fs:[00000030h] 9_2_04EC90AF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB20A0 mov eax, dword ptr fs:[00000030h] 9_2_04EB20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB20A0 mov eax, dword ptr fs:[00000030h] 9_2_04EB20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB20A0 mov eax, dword ptr fs:[00000030h] 9_2_04EB20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB20A0 mov eax, dword ptr fs:[00000030h] 9_2_04EB20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB20A0 mov eax, dword ptr fs:[00000030h] 9_2_04EB20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB20A0 mov eax, dword ptr fs:[00000030h] 9_2_04EB20A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBF0BF mov ecx, dword ptr fs:[00000030h] 9_2_04EBF0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBF0BF mov eax, dword ptr fs:[00000030h] 9_2_04EBF0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBF0BF mov eax, dword ptr fs:[00000030h] 9_2_04EBF0BF
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E89080 mov eax, dword ptr fs:[00000030h] 9_2_04E89080
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9849B mov eax, dword ptr fs:[00000030h] 9_2_04E9849B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F03884 mov eax, dword ptr fs:[00000030h] 9_2_04F03884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F03884 mov eax, dword ptr fs:[00000030h] 9_2_04F03884
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F51074 mov eax, dword ptr fs:[00000030h] 9_2_04F51074
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F42073 mov eax, dword ptr fs:[00000030h] 9_2_04F42073
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA746D mov eax, dword ptr fs:[00000030h] 9_2_04EA746D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBA44B mov eax, dword ptr fs:[00000030h] 9_2_04EBA44B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1C450 mov eax, dword ptr fs:[00000030h] 9_2_04F1C450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1C450 mov eax, dword ptr fs:[00000030h] 9_2_04F1C450
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA0050 mov eax, dword ptr fs:[00000030h] 9_2_04EA0050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA0050 mov eax, dword ptr fs:[00000030h] 9_2_04EA0050
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9B02A mov eax, dword ptr fs:[00000030h] 9_2_04E9B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9B02A mov eax, dword ptr fs:[00000030h] 9_2_04E9B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9B02A mov eax, dword ptr fs:[00000030h] 9_2_04E9B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9B02A mov eax, dword ptr fs:[00000030h] 9_2_04E9B02A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB002D mov eax, dword ptr fs:[00000030h] 9_2_04EB002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB002D mov eax, dword ptr fs:[00000030h] 9_2_04EB002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB002D mov eax, dword ptr fs:[00000030h] 9_2_04EB002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB002D mov eax, dword ptr fs:[00000030h] 9_2_04EB002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB002D mov eax, dword ptr fs:[00000030h] 9_2_04EB002D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBBC2C mov eax, dword ptr fs:[00000030h] 9_2_04EBBC2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F54015 mov eax, dword ptr fs:[00000030h] 9_2_04F54015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F54015 mov eax, dword ptr fs:[00000030h] 9_2_04F54015
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F07016 mov eax, dword ptr fs:[00000030h] 9_2_04F07016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F07016 mov eax, dword ptr fs:[00000030h] 9_2_04F07016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F07016 mov eax, dword ptr fs:[00000030h] 9_2_04F07016
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41C06 mov eax, dword ptr fs:[00000030h] 9_2_04F41C06
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F5740D mov eax, dword ptr fs:[00000030h] 9_2_04F5740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F5740D mov eax, dword ptr fs:[00000030h] 9_2_04F5740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F5740D mov eax, dword ptr fs:[00000030h] 9_2_04F5740D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06C0A mov eax, dword ptr fs:[00000030h] 9_2_04F06C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06C0A mov eax, dword ptr fs:[00000030h] 9_2_04F06C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06C0A mov eax, dword ptr fs:[00000030h] 9_2_04F06C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06C0A mov eax, dword ptr fs:[00000030h] 9_2_04F06C0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F38DF1 mov eax, dword ptr fs:[00000030h] 9_2_04F38DF1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8B1E1 mov eax, dword ptr fs:[00000030h] 9_2_04E8B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8B1E1 mov eax, dword ptr fs:[00000030h] 9_2_04E8B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8B1E1 mov eax, dword ptr fs:[00000030h] 9_2_04E8B1E1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9D5E0 mov eax, dword ptr fs:[00000030h] 9_2_04E9D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9D5E0 mov eax, dword ptr fs:[00000030h] 9_2_04E9D5E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4FDE2 mov eax, dword ptr fs:[00000030h] 9_2_04F4FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4FDE2 mov eax, dword ptr fs:[00000030h] 9_2_04F4FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4FDE2 mov eax, dword ptr fs:[00000030h] 9_2_04F4FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4FDE2 mov eax, dword ptr fs:[00000030h] 9_2_04F4FDE2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F141E8 mov eax, dword ptr fs:[00000030h] 9_2_04F141E8
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06DC9 mov eax, dword ptr fs:[00000030h] 9_2_04F06DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06DC9 mov eax, dword ptr fs:[00000030h] 9_2_04F06DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06DC9 mov eax, dword ptr fs:[00000030h] 9_2_04F06DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06DC9 mov ecx, dword ptr fs:[00000030h] 9_2_04F06DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06DC9 mov eax, dword ptr fs:[00000030h] 9_2_04F06DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F06DC9 mov eax, dword ptr fs:[00000030h] 9_2_04F06DC9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB35A1 mov eax, dword ptr fs:[00000030h] 9_2_04EB35A1
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB61A0 mov eax, dword ptr fs:[00000030h] 9_2_04EB61A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB61A0 mov eax, dword ptr fs:[00000030h] 9_2_04EB61A0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F051BE mov eax, dword ptr fs:[00000030h] 9_2_04F051BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F051BE mov eax, dword ptr fs:[00000030h] 9_2_04F051BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F051BE mov eax, dword ptr fs:[00000030h] 9_2_04F051BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F051BE mov eax, dword ptr fs:[00000030h] 9_2_04F051BE
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F069A6 mov eax, dword ptr fs:[00000030h] 9_2_04F069A6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F505AC mov eax, dword ptr fs:[00000030h] 9_2_04F505AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F505AC mov eax, dword ptr fs:[00000030h] 9_2_04F505AC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB1DB5 mov eax, dword ptr fs:[00000030h] 9_2_04EB1DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB1DB5 mov eax, dword ptr fs:[00000030h] 9_2_04EB1DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB1DB5 mov eax, dword ptr fs:[00000030h] 9_2_04EB1DB5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E82D8A mov eax, dword ptr fs:[00000030h] 9_2_04E82D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E82D8A mov eax, dword ptr fs:[00000030h] 9_2_04E82D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E82D8A mov eax, dword ptr fs:[00000030h] 9_2_04E82D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E82D8A mov eax, dword ptr fs:[00000030h] 9_2_04E82D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E82D8A mov eax, dword ptr fs:[00000030h] 9_2_04E82D8A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAC182 mov eax, dword ptr fs:[00000030h] 9_2_04EAC182
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB2581 mov eax, dword ptr fs:[00000030h] 9_2_04EB2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB2581 mov eax, dword ptr fs:[00000030h] 9_2_04EB2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB2581 mov eax, dword ptr fs:[00000030h] 9_2_04EB2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB2581 mov eax, dword ptr fs:[00000030h] 9_2_04EB2581
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBA185 mov eax, dword ptr fs:[00000030h] 9_2_04EBA185
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBFD9B mov eax, dword ptr fs:[00000030h] 9_2_04EBFD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBFD9B mov eax, dword ptr fs:[00000030h] 9_2_04EBFD9B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB2990 mov eax, dword ptr fs:[00000030h] 9_2_04EB2990
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8C962 mov eax, dword ptr fs:[00000030h] 9_2_04E8C962
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8B171 mov eax, dword ptr fs:[00000030h] 9_2_04E8B171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8B171 mov eax, dword ptr fs:[00000030h] 9_2_04E8B171
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAC577 mov eax, dword ptr fs:[00000030h] 9_2_04EAC577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAC577 mov eax, dword ptr fs:[00000030h] 9_2_04EAC577
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAB944 mov eax, dword ptr fs:[00000030h] 9_2_04EAB944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAB944 mov eax, dword ptr fs:[00000030h] 9_2_04EAB944
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC3D43 mov eax, dword ptr fs:[00000030h] 9_2_04EC3D43
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F03540 mov eax, dword ptr fs:[00000030h] 9_2_04F03540
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA7D50 mov eax, dword ptr fs:[00000030h] 9_2_04EA7D50
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F58D34 mov eax, dword ptr fs:[00000030h] 9_2_04F58D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F0A537 mov eax, dword ptr fs:[00000030h] 9_2_04F0A537
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA4120 mov eax, dword ptr fs:[00000030h] 9_2_04EA4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA4120 mov eax, dword ptr fs:[00000030h] 9_2_04EA4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA4120 mov eax, dword ptr fs:[00000030h] 9_2_04EA4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA4120 mov eax, dword ptr fs:[00000030h] 9_2_04EA4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA4120 mov ecx, dword ptr fs:[00000030h] 9_2_04EA4120
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4E539 mov eax, dword ptr fs:[00000030h] 9_2_04F4E539
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB4D3B mov eax, dword ptr fs:[00000030h] 9_2_04EB4D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB4D3B mov eax, dword ptr fs:[00000030h] 9_2_04EB4D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB4D3B mov eax, dword ptr fs:[00000030h] 9_2_04EB4D3B
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB513A mov eax, dword ptr fs:[00000030h] 9_2_04EB513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB513A mov eax, dword ptr fs:[00000030h] 9_2_04EB513A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8AD30 mov eax, dword ptr fs:[00000030h] 9_2_04E8AD30
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E93D34 mov eax, dword ptr fs:[00000030h] 9_2_04E93D34
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E89100 mov eax, dword ptr fs:[00000030h] 9_2_04E89100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E89100 mov eax, dword ptr fs:[00000030h] 9_2_04E89100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E89100 mov eax, dword ptr fs:[00000030h] 9_2_04E89100
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB16E0 mov ecx, dword ptr fs:[00000030h] 9_2_04EB16E0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E976E2 mov eax, dword ptr fs:[00000030h] 9_2_04E976E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB2AE4 mov eax, dword ptr fs:[00000030h] 9_2_04EB2AE4
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB2ACB mov eax, dword ptr fs:[00000030h] 9_2_04EB2ACB
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F58ED6 mov eax, dword ptr fs:[00000030h] 9_2_04F58ED6
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB36CC mov eax, dword ptr fs:[00000030h] 9_2_04EB36CC
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC8EC7 mov eax, dword ptr fs:[00000030h] 9_2_04EC8EC7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F3FEC0 mov eax, dword ptr fs:[00000030h] 9_2_04F3FEC0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E852A5 mov eax, dword ptr fs:[00000030h] 9_2_04E852A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E852A5 mov eax, dword ptr fs:[00000030h] 9_2_04E852A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E852A5 mov eax, dword ptr fs:[00000030h] 9_2_04E852A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E852A5 mov eax, dword ptr fs:[00000030h] 9_2_04E852A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E852A5 mov eax, dword ptr fs:[00000030h] 9_2_04E852A5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F50EA5 mov eax, dword ptr fs:[00000030h] 9_2_04F50EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F50EA5 mov eax, dword ptr fs:[00000030h] 9_2_04F50EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F50EA5 mov eax, dword ptr fs:[00000030h] 9_2_04F50EA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F046A7 mov eax, dword ptr fs:[00000030h] 9_2_04F046A7
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9AAB0 mov eax, dword ptr fs:[00000030h] 9_2_04E9AAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9AAB0 mov eax, dword ptr fs:[00000030h] 9_2_04E9AAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBFAB0 mov eax, dword ptr fs:[00000030h] 9_2_04EBFAB0
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F1FE87 mov eax, dword ptr fs:[00000030h] 9_2_04F1FE87
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBD294 mov eax, dword ptr fs:[00000030h] 9_2_04EBD294
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBD294 mov eax, dword ptr fs:[00000030h] 9_2_04EBD294
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E9766D mov eax, dword ptr fs:[00000030h] 9_2_04E9766D
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F3B260 mov eax, dword ptr fs:[00000030h] 9_2_04F3B260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F3B260 mov eax, dword ptr fs:[00000030h] 9_2_04F3B260
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC927A mov eax, dword ptr fs:[00000030h] 9_2_04EC927A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F58A62 mov eax, dword ptr fs:[00000030h] 9_2_04F58A62
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAAE73 mov eax, dword ptr fs:[00000030h] 9_2_04EAAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAAE73 mov eax, dword ptr fs:[00000030h] 9_2_04EAAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAAE73 mov eax, dword ptr fs:[00000030h] 9_2_04EAAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAAE73 mov eax, dword ptr fs:[00000030h] 9_2_04EAAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EAAE73 mov eax, dword ptr fs:[00000030h] 9_2_04EAAE73
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4EA55 mov eax, dword ptr fs:[00000030h] 9_2_04F4EA55
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F14257 mov eax, dword ptr fs:[00000030h] 9_2_04F14257
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E89240 mov eax, dword ptr fs:[00000030h] 9_2_04E89240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E89240 mov eax, dword ptr fs:[00000030h] 9_2_04E89240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E89240 mov eax, dword ptr fs:[00000030h] 9_2_04E89240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E89240 mov eax, dword ptr fs:[00000030h] 9_2_04E89240
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E97E41 mov eax, dword ptr fs:[00000030h] 9_2_04E97E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E97E41 mov eax, dword ptr fs:[00000030h] 9_2_04E97E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E97E41 mov eax, dword ptr fs:[00000030h] 9_2_04E97E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E97E41 mov eax, dword ptr fs:[00000030h] 9_2_04E97E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E97E41 mov eax, dword ptr fs:[00000030h] 9_2_04E97E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E97E41 mov eax, dword ptr fs:[00000030h] 9_2_04E97E41
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4AE44 mov eax, dword ptr fs:[00000030h] 9_2_04F4AE44
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F4AE44 mov eax, dword ptr fs:[00000030h] 9_2_04F4AE44
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC4A2C mov eax, dword ptr fs:[00000030h] 9_2_04EC4A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC4A2C mov eax, dword ptr fs:[00000030h] 9_2_04EC4A2C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8E620 mov eax, dword ptr fs:[00000030h] 9_2_04E8E620
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F3FE3F mov eax, dword ptr fs:[00000030h] 9_2_04F3FE3F
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E98A0A mov eax, dword ptr fs:[00000030h] 9_2_04E98A0A
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8C600 mov eax, dword ptr fs:[00000030h] 9_2_04E8C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8C600 mov eax, dword ptr fs:[00000030h] 9_2_04E8C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8C600 mov eax, dword ptr fs:[00000030h] 9_2_04E8C600
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB8E00 mov eax, dword ptr fs:[00000030h] 9_2_04EB8E00
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EA3A1C mov eax, dword ptr fs:[00000030h] 9_2_04EA3A1C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBA61C mov eax, dword ptr fs:[00000030h] 9_2_04EBA61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EBA61C mov eax, dword ptr fs:[00000030h] 9_2_04EBA61C
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E85210 mov eax, dword ptr fs:[00000030h] 9_2_04E85210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E85210 mov ecx, dword ptr fs:[00000030h] 9_2_04E85210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E85210 mov eax, dword ptr fs:[00000030h] 9_2_04E85210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E85210 mov eax, dword ptr fs:[00000030h] 9_2_04E85210
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F41608 mov eax, dword ptr fs:[00000030h] 9_2_04F41608
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8AA16 mov eax, dword ptr fs:[00000030h] 9_2_04E8AA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04E8AA16 mov eax, dword ptr fs:[00000030h] 9_2_04E8AA16
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EADBE9 mov eax, dword ptr fs:[00000030h] 9_2_04EADBE9
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB03E2 mov eax, dword ptr fs:[00000030h] 9_2_04EB03E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB03E2 mov eax, dword ptr fs:[00000030h] 9_2_04EB03E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB03E2 mov eax, dword ptr fs:[00000030h] 9_2_04EB03E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB03E2 mov eax, dword ptr fs:[00000030h] 9_2_04EB03E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB03E2 mov eax, dword ptr fs:[00000030h] 9_2_04EB03E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB03E2 mov eax, dword ptr fs:[00000030h] 9_2_04EB03E2
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EC37F5 mov eax, dword ptr fs:[00000030h] 9_2_04EC37F5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F053CA mov eax, dword ptr fs:[00000030h] 9_2_04F053CA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F053CA mov eax, dword ptr fs:[00000030h] 9_2_04F053CA
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB4BAD mov eax, dword ptr fs:[00000030h] 9_2_04EB4BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB4BAD mov eax, dword ptr fs:[00000030h] 9_2_04EB4BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04EB4BAD mov eax, dword ptr fs:[00000030h] 9_2_04EB4BAD
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F55BA5 mov eax, dword ptr fs:[00000030h] 9_2_04F55BA5
Source: C:\Windows\SysWOW64\colorcpl.exe Code function: 9_2_04F07794 mov eax, dword ptr fs:[00000030h] 9_2_04F07794
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\bhjRru88ej.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 1_2_00409B50 LdrLoadDll, 1_2_00409B50
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_1001B986 SetUnhandledExceptionFilter,UnhandledExceptionFilter, 0_2_1001B986

HIPS / PFW / Operating System Protection Evasion:

barindex
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\bhjRru88ej.exe Section unmapped: C:\Windows\SysWOW64\colorcpl.exe base address: AC0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\bhjRru88ej.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\bhjRru88ej.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\bhjRru88ej.exe Section loaded: unknown target: C:\Windows\SysWOW64\colorcpl.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\bhjRru88ej.exe Memory written: C:\Users\user\Desktop\bhjRru88ej.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Thread register set: target process: 3440 Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Thread register set: target process: 3864 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Process created: C:\Users\user\Desktop\bhjRru88ej.exe "C:\Users\user\Desktop\bhjRru88ej.exe" Jump to behavior
Source: C:\Windows\SysWOW64\colorcpl.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\bhjRru88ej.exe" Jump to behavior
Source: explorer.exe, 00000014.00000000.520207902.0000000001397000.00000004.00000020.sdmp, explorer.exe, 00000014.00000000.584357358.0000000001397000.00000004.00000020.sdmp Binary or memory string: Progman24@
Source: colorcpl.exe, 00000009.00000002.630892401.0000000003710000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000004.00000000.459465275.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.398639162.00000000083E9000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.392582707.0000000004F80000.00000004.00000001.sdmp, explorer.exe, 00000004.00000000.391133927.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.356150962.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.377379137.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.367808794.00000000083E9000.00000004.00000001.sdmp, colorcpl.exe, 00000009.00000002.630892401.0000000003710000.00000002.00020000.sdmp, explorer.exe, 00000014.00000000.520799861.000000000147E000.00000004.00000020.sdmp, explorer.exe, 00000014.00000000.522351385.0000000001A80000.00000002.00020000.sdmp, explorer.exe, 00000014.00000000.585119276.000000000147E000.00000004.00000020.sdmp, explorer.exe, 00000014.00000000.537878920.00000000055F0000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.591415559.00000000055F0000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.585769726.0000000001A80000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000004.00000000.459465275.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.376324112.00000000008B8000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.390761825.00000000008B8000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.391133927.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.355656357.00000000008B8000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.356150962.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.458866350.00000000008B8000.00000004.00000020.sdmp, explorer.exe, 00000004.00000000.377379137.0000000000EE0000.00000002.00020000.sdmp, colorcpl.exe, 00000009.00000002.630892401.0000000003710000.00000002.00020000.sdmp, explorer.exe, 00000014.00000000.522351385.0000000001A80000.00000002.00020000.sdmp, explorer.exe, 00000014.00000000.537878920.00000000055F0000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.591415559.00000000055F0000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.585769726.0000000001A80000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000014.00000000.537267605.0000000005333000.00000004.00000001.sdmp, explorer.exe, 00000014.00000000.590545780.0000000005333000.00000004.00000001.sdmp Binary or memory string: ProgmanD
Source: explorer.exe, 00000004.00000000.459465275.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.391133927.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.356150962.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.377379137.0000000000EE0000.00000002.00020000.sdmp Binary or memory string: &Program Manager
Source: explorer.exe, 00000004.00000000.459465275.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.391133927.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.356150962.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000004.00000000.377379137.0000000000EE0000.00000002.00020000.sdmp, explorer.exe, 00000014.00000000.522351385.0000000001A80000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000014.00000000.522351385.0000000001A80000.00000002.00020000.sdmp, explorer.exe, 00000014.00000000.585769726.0000000001A80000.00000002.00020000.sdmp Binary or memory string: }Program Manager

Language, Device and Operating System Detection:

barindex
Contains functionality to query CPU information (cpuid)
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_10018A2D cpuid 0_2_10018A2D
Source: C:\Users\user\Desktop\bhjRru88ej.exe Code function: 0_2_0040594D GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 0_2_0040594D

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 1.1.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bhjRru88ej.exe.25d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bhjRru88ej.exe.25d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413560341.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.384139517.00000000075EE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.397566356.00000000075EE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.353597466.00000000025D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413505967.00000000005C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.630654958.0000000002FB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413413880.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.350595433.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.352601050.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.351883848.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.630203304.0000000002EB0000.00000040.00020000.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 1.1.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bhjRru88ej.exe.25d0000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.1.bhjRru88ej.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.3.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 0.2.bhjRru88ej.exe.25d0000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.0.bhjRru88ej.exe.400000.3.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.bhjRru88ej.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000009.00000002.625740978.0000000000BC0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413560341.00000000009D0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.384139517.00000000075EE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000000.397566356.00000000075EE000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.353597466.00000000025D0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413505967.00000000005C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.630654958.0000000002FB0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.413413880.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.350595433.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000001.352601050.0000000000400000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000000.351883848.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.630203304.0000000002EB0000.00000040.00020000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532826 Sample: bhjRru88ej Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 30 Multi AV Scanner detection for domain / URL 2->30 32 Found malware configuration 2->32 34 Malicious sample detected (through community Yara rule) 2->34 36 3 other signatures 2->36 10 bhjRru88ej.exe 17 2->10         started        process3 file4 28 C:\Users\user\AppData\...\kxovistzen.dll, PE32 10->28 dropped 46 Tries to detect virtualization through RDTSC time measurements 10->46 48 Injects a PE file into a foreign processes 10->48 14 bhjRru88ej.exe 10->14         started        signatures5 process6 signatures7 50 Modifies the context of a thread in another process (thread injection) 14->50 52 Maps a DLL or memory area into another process 14->52 54 Sample uses process hollowing technique 14->54 56 Queues an APC in another process (thread injection) 14->56 17 explorer.exe 14->17 injected process8 process9 19 colorcpl.exe 17->19         started        signatures10 38 Self deletion via cmd delete 19->38 40 Modifies the context of a thread in another process (thread injection) 19->40 42 Maps a DLL or memory area into another process 19->42 44 Tries to detect virtualization through RDTSC time measurements 19->44 22 cmd.exe 1 19->22         started        24 explorer.exe 2 147 19->24         started        process11 process12 26 conhost.exe 22->26         started       
No contacted IP infos

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.drmichaelirvine.com/yrcy/ true
  • 7%, Virustotal, Browse
  • Avira URL Cloud: safe
 low