Windows Analysis Report 20211016-113459_Banco Cajamar.exe

Overview

General Information

Sample Name: 20211016-113459_Banco Cajamar.exe
Analysis ID: 532899
MD5: ac5a3bebe7e44737930399317246c31f
SHA1: ee33d7600dfb3e9bc888e79126ad66b001db405f
SHA256: ba2972170824e9bb06c18fce3fcfa5d52411163bc1ecdc55e7fe94fac3ba96ad
Tags: exeformbook
Infos:

Most interesting Screenshot:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
Yara detected AntiVM3
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Multi AV Scanner detection for domain / URL
Sample uses process hollowing technique
Uses netstat to query active network connections and open ports
Maps a DLL or memory area into another process
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Modifies the prolog of user mode functions (user mode inline hooks)
Self deletion via cmd delete
Injects a PE file into a foreign processes
Sigma detected: Powershell Defender Exclusion
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Adds a directory exclusion to Windows Defender
Uses 32bit PE files
Queries the volume information (name, serial number etc) of a device
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Contains long sleeps (>= 3 min)
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Sample file is different than original file name gathered from version info
PE file contains strange resources
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)

Classification

AV Detection:

barindex
Found malware configuration
Source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.etaiiler.com/n3p2/"], "decoy": ["fastliteexpress.com", "xu0huwsbbff.xyz", "consultkauai.com", "plfdjs.com", "sbspeedreducer.com", "petrasnavickas.com", "streetfood-db.com", "cszpyz.com", "metagravitygroup.com", "zimroom.com", "funny-eyes-lenses.com", "aromavozduh.com", "imperialreisen.com", "task-resources.com", "791hc.com", "peiyusw.com", "architectjoegar.com", "metamaster3d.com", "teamas.store", "nftliterature.net", "thebestteeshop.com", "sildenafilcitrate100.quest", "younggunsmedia.agency", "mesoandfillers.com", "metaverseprotocol.info", "zimobogrev.site", "260nn.xyz", "ahydparts.com", "ig-verifymail.com", "dommecertificationcourse.com", "manifestationu.com", "farmahempfull.com", "strikesaserbisyo.online", "meysamasharin.com", "safonicbusiness.com", "enerjenn.com", "metaversetulsa.com", "mychmedicare.com", "yemdzosports.com", "merdacbuiter.quest", "fosssports.net", "elbaestes.com", "privateequity.ventures", "cyfarthfa.net", "nullroute.wtf", "swhgbx.com", "57k8s.com", "fozz.tech", "ofduae.xyz", "theplatinumexotics.com", "abbayedebonlieu.com", "simivalleytinting.com", "ultracareobgyn.com", "fkyhd.com", "yyjcx.com", "global-visa.agency", "schaffensfreude.com", "rprp6.com", "elevatorjustice.com", "holidaycashflow.com", "schritechlabs.com", "sabutl.online", "exportetonauto.com", "metaversequity.com"]}
Multi AV Scanner detection for submitted file
Source: 20211016-113459_Banco Cajamar.exe Virustotal: Detection: 46% Perma Link
Source: 20211016-113459_Banco Cajamar.exe Metadefender: Detection: 22% Perma Link
Source: 20211016-113459_Banco Cajamar.exe ReversingLabs: Detection: 78%
Yara detected FormBook
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.296459944.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.296910307.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.553599848.00000000006C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353139418.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353353026.0000000000C10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353654430.0000000000FA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.553890996.00000000008A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.302482435.0000000004094000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.332876311.0000000010339000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.etaiiler.com/n3p2/ Avira URL Cloud: Label: malware
Multi AV Scanner detection for domain / URL
Source: www.etaiiler.com/n3p2/ Virustotal: Detection: 5% Perma Link
Antivirus or Machine Learning detection for unpacked file
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance:

barindex
Uses 32bit PE files
Source: 20211016-113459_Banco Cajamar.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: 20211016-113459_Banco Cajamar.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353739525.00000000011A0000.00000040.00000001.sdmp, 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353848677.00000000012BF000.00000040.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.554108049.0000000000A40000.00000040.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.554429399.0000000000B5F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 20211016-113459_Banco Cajamar.exe, 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353739525.00000000011A0000.00000040.00000001.sdmp, 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353848677.00000000012BF000.00000040.00000001.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000008.00000002.554108049.0000000000A40000.00000040.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.554429399.0000000000B5F000.00000040.00000001.sdmp

Networking:

barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49771 -> 170.130.100.87:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49771 -> 170.130.100.87:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.3:49771 -> 170.130.100.87:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 170.130.100.87 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.yemdzosports.com
Source: C:\Windows\explorer.exe Domain query: www.cyfarthfa.net
Source: C:\Windows\explorer.exe Network Connect: 81.17.29.148 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mychmedicare.com
Uses netstat to query active network connections and open ports
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.etaiiler.com/n3p2/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: EONIX-COMMUNICATIONS-ASBLOCK-62904US EONIX-COMMUNICATIONS-ASBLOCK-62904US
Source: Joe Sandbox View ASN Name: PLI-ASCH PLI-ASCH
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /n3p2/?w48hcRa8=SdlvFPFPNJUXoYnYWPLl1NDgE+mKeZK73sBL4F/2nNmRYNNl/NkypmCCXxB3WemnB+6Z&mR-T=06_Xpn HTTP/1.1Host: www.mychmedicare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /n3p2/?w48hcRa8=pP9iPkU5ljc4gzlHk8IebnWX5ntvLryeSfIO8DzZWQrTvPM83xL3AI3ZDxgTOTaN0wEH&mR-T=06_Xpn HTTP/1.1Host: www.cyfarthfa.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 81.17.29.148 81.17.29.148
Source: explorer.exe, 00000005.00000000.332345461.000000000EEFC000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.313898306.000000000EEFC000.00000004.00000001.sdmp String found in binary or memory: http://schemas.micr
Source: NETSTAT.EXE, 00000008.00000002.555098944.000000000398F000.00000004.00020000.sdmp String found in binary or memory: http://survey-smiles.com
Source: unknown DNS traffic detected: queries for: www.mychmedicare.com
Source: global traffic HTTP traffic detected: GET /n3p2/?w48hcRa8=SdlvFPFPNJUXoYnYWPLl1NDgE+mKeZK73sBL4F/2nNmRYNNl/NkypmCCXxB3WemnB+6Z&mR-T=06_Xpn HTTP/1.1Host: www.mychmedicare.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /n3p2/?w48hcRa8=pP9iPkU5ljc4gzlHk8IebnWX5ntvLryeSfIO8DzZWQrTvPM83xL3AI3ZDxgTOTaN0wEH&mR-T=06_Xpn HTTP/1.1Host: www.cyfarthfa.netConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

E-Banking Fraud:

barindex
Yara detected FormBook
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.296459944.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.296910307.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.553599848.00000000006C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353139418.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353353026.0000000000C10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353654430.0000000000FA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.553890996.00000000008A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.302482435.0000000004094000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.332876311.0000000010339000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp, type: MEMORY

System Summary:

barindex
Malicious sample detected (through community Yara rule)
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.296459944.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.296459944.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.296910307.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.296910307.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.553599848.00000000006C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.553599848.00000000006C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.353139418.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.353139418.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.353353026.0000000000C10000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.353353026.0000000000C10000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.353654430.0000000000FA0000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.353654430.0000000000FA0000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000008.00000002.553890996.00000000008A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000008.00000002.553890996.00000000008A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.302482435.0000000004094000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.302482435.0000000004094000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.332876311.0000000010339000.00000040.00020000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.332876311.0000000010339000.00000040.00020000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: 20211016-113459_Banco Cajamar.exe Static PE information: 32BIT_MACHINE, EXECUTABLE_IMAGE
Yara signature match
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.296459944.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.296459944.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.296910307.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.296910307.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.553599848.00000000006C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.553599848.00000000006C0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.353139418.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.353139418.0000000000400000.00000040.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.353353026.0000000000C10000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.353353026.0000000000C10000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.353654430.0000000000FA0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.353654430.0000000000FA0000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000008.00000002.553890996.00000000008A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000008.00000002.553890996.00000000008A0000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.302482435.0000000004094000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.302482435.0000000004094000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.332876311.0000000010339000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.332876311.0000000010339000.00000040.00020000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Detected potential crypto function
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_007C50C2 0_2_007C50C2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_05001CD0 0_2_05001CD0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_05000AD6 0_2_05000AD6
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_05001D78 0_2_05001D78
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_05001006 0_2_05001006
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_05003880 0_2_05003880
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_05003890 0_2_05003890
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_05003ACE 0_2_05003ACE
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_05003AD8 0_2_05003AD8
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041D9C4 3_2_0041D9C4
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00402D87 3_2_00402D87
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041D593 3_2_0041D593
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041DDAE 3_2_0041DDAE
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00409E4B 3_2_00409E4B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00409E50 3_2_00409E50
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_006850C2 3_2_006850C2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CF900 3_2_011CF900
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E4120 3_2_011E4120
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281002 3_2_01281002
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012920A8 3_2_012920A8
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DB090 3_2_011DB090
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F20A0 3_2_011F20A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012928EC 3_2_012928EC
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01292B28 3_2_01292B28
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FEBB0 3_2_011FEBB0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128DBD2 3_2_0128DBD2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012922AE 3_2_012922AE
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01292D07 3_2_01292D07
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C0D20 3_2_011C0D20
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01291D55 3_2_01291D55
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2581 3_2_011F2581
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012925DD 3_2_012925DD
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DD5E0 3_2_011DD5E0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D841F 3_2_011D841F
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128D466 3_2_0128D466
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01291FF1 3_2_01291FF1
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E6E30 3_2_011E6E30
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01292EF7 3_2_01292EF7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A920A0 8_2_00A920A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B320A8 8_2_00B320A8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7B090 8_2_00A7B090
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B328EC 8_2_00B328EC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B3E824 8_2_00B3E824
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21002 8_2_00B21002
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A84120 8_2_00A84120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6F900 8_2_00A6F900
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B322AE 8_2_00B322AE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9EBB0 8_2_00A9EBB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2DBD2 8_2_00B2DBD2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B203DA 8_2_00B203DA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B32B28 8_2_00B32B28
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7841F 8_2_00A7841F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2D466 8_2_00B2D466
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92581 8_2_00A92581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7D5E0 8_2_00A7D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B325DD 8_2_00B325DD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A60D20 8_2_00A60D20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B32D07 8_2_00B32D07
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B31D55 8_2_00B31D55
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B32EF7 8_2_00B32EF7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A86E30 8_2_00A86E30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2D616 8_2_00B2D616
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B31FF1 8_2_00B31FF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B3DFCE 8_2_00B3DFCE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015D9C4 8_2_0015D9C4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00142D90 8_2_00142D90
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015D593 8_2_0015D593
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00142D87 8_2_00142D87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015DDAE 8_2_0015DDAE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00149E50 8_2_00149E50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00149E4B 8_2_00149E4B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00142FB0 8_2_00142FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: String function: 00A6B150 appears 35 times
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: String function: 011CB150 appears 35 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041A350 NtCreateFile, 3_2_0041A350
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041A400 NtReadFile, 3_2_0041A400
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041A480 NtClose, 3_2_0041A480
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041A530 NtAllocateVirtualMemory, 3_2_0041A530
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041A3FA NtReadFile, 3_2_0041A3FA
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041A52A NtAllocateVirtualMemory, 3_2_0041A52A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_01209910
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012099A0 NtCreateSection,LdrInitializeThunk, 3_2_012099A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_01209860
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209840 NtDelayExecution,LdrInitializeThunk, 3_2_01209840
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012098F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_012098F0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209A20 NtResumeThread,LdrInitializeThunk, 3_2_01209A20
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_01209A00
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209A50 NtCreateFile,LdrInitializeThunk, 3_2_01209A50
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209540 NtReadFile,LdrInitializeThunk, 3_2_01209540
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012095D0 NtClose,LdrInitializeThunk, 3_2_012095D0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209710 NtQueryInformationToken,LdrInitializeThunk, 3_2_01209710
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012097A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_012097A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209780 NtMapViewOfSection,LdrInitializeThunk, 3_2_01209780
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_01209660
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012096E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_012096E0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209950 NtQueueApcThread, 3_2_01209950
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012099D0 NtCreateProcessEx, 3_2_012099D0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209820 NtEnumerateKey, 3_2_01209820
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0120B040 NtSuspendThread, 3_2_0120B040
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012098A0 NtWriteVirtualMemory, 3_2_012098A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209B00 NtSetValueKey, 3_2_01209B00
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0120A3B0 NtGetContextThread, 3_2_0120A3B0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209A10 NtQuerySection, 3_2_01209A10
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209A80 NtOpenDirectoryObject, 3_2_01209A80
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209520 NtWaitForSingleObject, 3_2_01209520
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0120AD30 NtSetContextThread, 3_2_0120AD30
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209560 NtWriteFile, 3_2_01209560
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012095F0 NtQueryInformationFile, 3_2_012095F0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209730 NtQueryVirtualMemory, 3_2_01209730
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0120A710 NtOpenProcessToken, 3_2_0120A710
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209760 NtOpenProcess, 3_2_01209760
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0120A770 NtOpenThread, 3_2_0120A770
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209770 NtSetInformationFile, 3_2_01209770
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209FE0 NtCreateMutant, 3_2_01209FE0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209610 NtEnumerateValueKey, 3_2_01209610
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209670 NtQueryInformationProcess, 3_2_01209670
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01209650 NtQueryValueKey, 3_2_01209650
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012096D0 NtCreateKey, 3_2_012096D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9860 NtQuerySystemInformation,LdrInitializeThunk, 8_2_00AA9860
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9840 NtDelayExecution,LdrInitializeThunk, 8_2_00AA9840
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA99A0 NtCreateSection,LdrInitializeThunk, 8_2_00AA99A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 8_2_00AA9910
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9A50 NtCreateFile,LdrInitializeThunk, 8_2_00AA9A50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA95D0 NtClose,LdrInitializeThunk, 8_2_00AA95D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9540 NtReadFile,LdrInitializeThunk, 8_2_00AA9540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA96E0 NtFreeVirtualMemory,LdrInitializeThunk, 8_2_00AA96E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA96D0 NtCreateKey,LdrInitializeThunk, 8_2_00AA96D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9660 NtAllocateVirtualMemory,LdrInitializeThunk, 8_2_00AA9660
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9650 NtQueryValueKey,LdrInitializeThunk, 8_2_00AA9650
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9780 NtMapViewOfSection,LdrInitializeThunk, 8_2_00AA9780
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9FE0 NtCreateMutant,LdrInitializeThunk, 8_2_00AA9FE0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9710 NtQueryInformationToken,LdrInitializeThunk, 8_2_00AA9710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA98A0 NtWriteVirtualMemory, 8_2_00AA98A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA98F0 NtReadVirtualMemory, 8_2_00AA98F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9820 NtEnumerateKey, 8_2_00AA9820
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AAB040 NtSuspendThread, 8_2_00AAB040
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA99D0 NtCreateProcessEx, 8_2_00AA99D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9950 NtQueueApcThread, 8_2_00AA9950
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9A80 NtOpenDirectoryObject, 8_2_00AA9A80
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9A20 NtResumeThread, 8_2_00AA9A20
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9A00 NtProtectVirtualMemory, 8_2_00AA9A00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9A10 NtQuerySection, 8_2_00AA9A10
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AAA3B0 NtGetContextThread, 8_2_00AAA3B0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9B00 NtSetValueKey, 8_2_00AA9B00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA95F0 NtQueryInformationFile, 8_2_00AA95F0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9520 NtWaitForSingleObject, 8_2_00AA9520
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AAAD30 NtSetContextThread, 8_2_00AAAD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9560 NtWriteFile, 8_2_00AA9560
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9610 NtEnumerateValueKey, 8_2_00AA9610
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9670 NtQueryInformationProcess, 8_2_00AA9670
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA97A0 NtUnmapViewOfSection, 8_2_00AA97A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9730 NtQueryVirtualMemory, 8_2_00AA9730
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AAA710 NtOpenProcessToken, 8_2_00AAA710
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9760 NtOpenProcess, 8_2_00AA9760
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AAA770 NtOpenThread, 8_2_00AAA770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA9770 NtSetInformationFile, 8_2_00AA9770
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015A350 NtCreateFile, 8_2_0015A350
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015A400 NtReadFile, 8_2_0015A400
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015A480 NtClose, 8_2_0015A480
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015A530 NtAllocateVirtualMemory, 8_2_0015A530
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015A3FA NtReadFile, 8_2_0015A3FA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_0015A52A NtAllocateVirtualMemory, 8_2_0015A52A
Sample file is different than original file name gathered from version info
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300457891.0000000002E97000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs 20211016-113459_Banco Cajamar.exe
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000000.287616313.0000000000822000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameIDeferredDisposab.exe@ vs 20211016-113459_Banco Cajamar.exe
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.303902077.0000000005280000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameInnerException.dll" vs 20211016-113459_Banco Cajamar.exe
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.304337739.0000000005890000.00000004.00020000.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs 20211016-113459_Banco Cajamar.exe
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp Binary or memory string: OriginalFilenameUI.dll@ vs 20211016-113459_Banco Cajamar.exe
Source: 20211016-113459_Banco Cajamar.exe, 00000003.00000002.354071612.000000000144F000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 20211016-113459_Banco Cajamar.exe
Source: 20211016-113459_Banco Cajamar.exe, 00000003.00000000.295637899.00000000006E2000.00000002.00020000.sdmp Binary or memory string: OriginalFilenameIDeferredDisposab.exe@ vs 20211016-113459_Banco Cajamar.exe
Source: 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353848677.00000000012BF000.00000040.00000001.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs 20211016-113459_Banco Cajamar.exe
Source: 20211016-113459_Banco Cajamar.exe Binary or memory string: OriginalFilenameIDeferredDisposab.exe@ vs 20211016-113459_Banco Cajamar.exe
PE file contains strange resources
Source: 20211016-113459_Banco Cajamar.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 20211016-113459_Banco Cajamar.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 20211016-113459_Banco Cajamar.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 20211016-113459_Banco Cajamar.exe Static PE information: Resource name: RT_ICON type: GLS_BINARY_LSB_FIRST
Source: 20211016-113459_Banco Cajamar.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: 20211016-113459_Banco Cajamar.exe Virustotal: Detection: 46%
Source: 20211016-113459_Banco Cajamar.exe Metadefender: Detection: 22%
Source: 20211016-113459_Banco Cajamar.exe ReversingLabs: Detection: 78%
Source: 20211016-113459_Banco Cajamar.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe"
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process created: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\NETSTAT.EXE C:\Windows\SysWOW64\NETSTAT.EXE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process created: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe" Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{95E15D0A-66E6-93D9-C53C-76E6219D3341}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe File created: C:\Users\user\AppData\Local\Microsoft\CLR_v2.0_32\UsageLogs\20211016-113459_Banco Cajamar.exe.log Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe File created: C:\Users\user\AppData\Local\Temp\__PSScriptPolicyTest_oqoavsik.5kk.ps1 Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@10/5@3/2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe File read: C:\Users\user\Desktop\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Section loaded: C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9603718106bd57ecfbb18fefd769cab4\mscorlib.ni.dll Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sorttbls.nlp Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Section loaded: C:\Windows\assembly\GAC_32\mscorlib\2.0.0.0__b77a5c561934e089\sortkey.nlp Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Section loaded: C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\a152fe02a317a77aeee36903305e8ba6\mscorlib.ni.dll Jump to behavior
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:5912:120:WilError_01
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1952:120:WilError_01
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A77D72 FindResourceA, 8_2_00A77D72
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: ../Images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: ../Images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: ../Images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: ../Images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: Class%50617273696E67496E%74574E6179384D574B%../Images/Play.gif'../Images/Pause.gif%../Images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: Class%50617273696E67496E%74574E6179384D574B%../Images/Play.gif'../Images/Pause.gif%../Images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: images/stop.gifp
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: images/stop.gifp
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: Images/stop.gif
Source: 20211016-113459_Banco Cajamar.exe String found in binary or memory: Images/stop.gif
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe File opened: C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorrc.dll Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe File opened: C:\Windows\WinSxS\x86_microsoft.vc80.crt_1fc8b3b9a1e18e3b_8.0.50727.9445_none_d08c58b4442ba54f\MSVCR80.dll Jump to behavior
Source: 20211016-113459_Banco Cajamar.exe Static PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR
Source: 20211016-113459_Banco Cajamar.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353739525.00000000011A0000.00000040.00000001.sdmp, 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353848677.00000000012BF000.00000040.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.554108049.0000000000A40000.00000040.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.554429399.0000000000B5F000.00000040.00000001.sdmp
Source: Binary string: wntdll.pdb source: 20211016-113459_Banco Cajamar.exe, 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353739525.00000000011A0000.00000040.00000001.sdmp, 20211016-113459_Banco Cajamar.exe, 00000003.00000002.353848677.00000000012BF000.00000040.00000001.sdmp, NETSTAT.EXE, NETSTAT.EXE, 00000008.00000002.554108049.0000000000A40000.00000040.00000001.sdmp, NETSTAT.EXE, 00000008.00000002.554429399.0000000000B5F000.00000040.00000001.sdmp

Data Obfuscation:

barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2F88 push eax; retf 0_2_028C3006
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2B9C push ecx; retf 0_2_028C2B9E
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2798 push edi; retf 0_2_028C27AA
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2C90 push eax; retf 0_2_028C2C9A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2BBC push ecx; retf 0_2_028C2BC2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C26B5 push edi; retf 0_2_028C27AA
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C26B5 pushfd ; iretd 0_2_028C2806
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2EEC push eax; retf 0_2_028C2F0A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2EEC push eax; retf 0_2_028C2F3A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2EEC push edi; retf 0_2_028C2F76
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2FE8 push eax; retf 0_2_028C3006
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2FF4 push eax; retf 0_2_028C3006
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C280C push edi; retf 0_2_028C27AA
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C280C pushfd ; iretd 0_2_028C2806
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2E09 push edx; iretd 0_2_028C2E0A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2F04 push eax; retf 0_2_028C2F0A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2F10 push eax; retf 0_2_028C2F3A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C254C pushfd ; iretd 0_2_028C255A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2F58 push edi; retf 0_2_028C2F76
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2F7C push eax; retf 0_2_028C2F3A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2F7C push edi; retf 0_2_028C2F82
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028C2A74 pushfd ; iretd 0_2_028C2A7A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_028D9F8B push esp; ret 0_2_028D9F9D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 0_2_0500808B push ecx; iretd 0_2_0500808C
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00410873 push esp; iretd 3_2_00410874
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00416813 pushad ; ret 3_2_00416847
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00416839 pushad ; ret 3_2_00416847
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_004169D2 push ebx; ret 3_2_004169D5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0040E343 push edi; iretd 3_2_0040E396
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0041E31E push esi; retf 3_2_0041E32B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0040E3D1 push edi; iretd 3_2_0040E396
Source: initial sample Static PE information: section name: .text entropy: 7.94252920188

Hooking and other Techniques for Hiding and Protection:

barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x85 0x5E 0xE2
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: /c del "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe"
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: /c del "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe" Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion:

barindex
Yara detected AntiVM3
Source: Yara match File source: 0.2.20211016-113459_Banco Cajamar.exe.2e9b9c8.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000000.00000002.300457891.0000000002E97000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.300370815.0000000002E61000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: Process Memory Space: 20211016-113459_Banco Cajamar.exe PID: 6408, type: MEMORYSTR
Tries to detect sandboxes and other dynamic analysis tools (process name or module or function)
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300457891.0000000002E97000.00000004.00000001.sdmp, 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300370815.0000000002E61000.00000004.00000001.sdmp Binary or memory string: SBIEDLL.DLL
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300457891.0000000002E97000.00000004.00000001.sdmp, 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300370815.0000000002E61000.00000004.00000001.sdmp Binary or memory string: KERNEL32.DLL.WINE_GET_UNIX_FILE_NAME
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 0000000000149904 second address: 000000000014990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\NETSTAT.EXE RDTSC instruction interceptor: First address: 0000000000149B6E second address: 0000000000149B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe TID: 6412 Thread sleep time: -36523s >= -30000s Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe TID: 6392 Thread sleep time: -922337203685477s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe TID: 6484 Thread sleep time: -3689348814741908s >= -30000s Jump to behavior
Source: C:\Windows\explorer.exe TID: 5516 Thread sleep time: -52000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE TID: 6760 Thread sleep time: -38000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\NETSTAT.EXE Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Contains long sleeps (>= 3 min)
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 6668 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Window / User API: threadDelayed 1867 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Thread delayed: delay time: 36523 Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Thread delayed: delay time: 922337203685477 Jump to behavior
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300370815.0000000002E61000.00000004.00000001.sdmp Binary or memory string: VMware SVGA IIBAdd-MpPreference -ExclusionPath "
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300370815.0000000002E61000.00000004.00000001.sdmp Binary or memory string: InstallPathJC:\PROGRAM FILES\VMWARE\VMWARE TOOLS\
Source: explorer.exe, 00000005.00000000.329672647.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300370815.0000000002E61000.00000004.00000001.sdmp Binary or memory string: vmware
Source: explorer.exe, 00000005.00000000.329782566.0000000008778000.00000004.00000001.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000}
Source: explorer.exe, 00000005.00000000.329672647.00000000086C9000.00000004.00000001.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}&
Source: explorer.exe, 00000005.00000000.326447294.00000000067C2000.00000004.00000001.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.326447294.00000000067C2000.00000004.00000001.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000m32)
Source: explorer.exe, 00000005.00000000.329672647.00000000086C9000.00000004.00000001.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Source: 20211016-113459_Banco Cajamar.exe, 00000000.00000002.300370815.0000000002E61000.00000004.00000001.sdmp Binary or memory string: VMWAREDSOFTWARE\VMware, Inc.\VMware Tools

Anti Debugging:

barindex
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Enables debug privileges
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Process token adjusted: Debug Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C9100 mov eax, dword ptr fs:[00000030h] 3_2_011C9100
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C9100 mov eax, dword ptr fs:[00000030h] 3_2_011C9100
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C9100 mov eax, dword ptr fs:[00000030h] 3_2_011C9100
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F513A mov eax, dword ptr fs:[00000030h] 3_2_011F513A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F513A mov eax, dword ptr fs:[00000030h] 3_2_011F513A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E4120 mov eax, dword ptr fs:[00000030h] 3_2_011E4120
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E4120 mov eax, dword ptr fs:[00000030h] 3_2_011E4120
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E4120 mov eax, dword ptr fs:[00000030h] 3_2_011E4120
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E4120 mov eax, dword ptr fs:[00000030h] 3_2_011E4120
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E4120 mov ecx, dword ptr fs:[00000030h] 3_2_011E4120
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EB944 mov eax, dword ptr fs:[00000030h] 3_2_011EB944
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EB944 mov eax, dword ptr fs:[00000030h] 3_2_011EB944
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CB171 mov eax, dword ptr fs:[00000030h] 3_2_011CB171
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CB171 mov eax, dword ptr fs:[00000030h] 3_2_011CB171
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CC962 mov eax, dword ptr fs:[00000030h] 3_2_011CC962
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012469A6 mov eax, dword ptr fs:[00000030h] 3_2_012469A6
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2990 mov eax, dword ptr fs:[00000030h] 3_2_011F2990
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FA185 mov eax, dword ptr fs:[00000030h] 3_2_011FA185
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012451BE mov eax, dword ptr fs:[00000030h] 3_2_012451BE
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012451BE mov eax, dword ptr fs:[00000030h] 3_2_012451BE
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012451BE mov eax, dword ptr fs:[00000030h] 3_2_012451BE
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012451BE mov eax, dword ptr fs:[00000030h] 3_2_012451BE
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EC182 mov eax, dword ptr fs:[00000030h] 3_2_011EC182
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F61A0 mov eax, dword ptr fs:[00000030h] 3_2_011F61A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F61A0 mov eax, dword ptr fs:[00000030h] 3_2_011F61A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012541E8 mov eax, dword ptr fs:[00000030h] 3_2_012541E8
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CB1E1 mov eax, dword ptr fs:[00000030h] 3_2_011CB1E1
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CB1E1 mov eax, dword ptr fs:[00000030h] 3_2_011CB1E1
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CB1E1 mov eax, dword ptr fs:[00000030h] 3_2_011CB1E1
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01247016 mov eax, dword ptr fs:[00000030h] 3_2_01247016
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01247016 mov eax, dword ptr fs:[00000030h] 3_2_01247016
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01247016 mov eax, dword ptr fs:[00000030h] 3_2_01247016
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F002D mov eax, dword ptr fs:[00000030h] 3_2_011F002D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F002D mov eax, dword ptr fs:[00000030h] 3_2_011F002D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F002D mov eax, dword ptr fs:[00000030h] 3_2_011F002D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F002D mov eax, dword ptr fs:[00000030h] 3_2_011F002D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F002D mov eax, dword ptr fs:[00000030h] 3_2_011F002D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DB02A mov eax, dword ptr fs:[00000030h] 3_2_011DB02A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DB02A mov eax, dword ptr fs:[00000030h] 3_2_011DB02A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DB02A mov eax, dword ptr fs:[00000030h] 3_2_011DB02A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DB02A mov eax, dword ptr fs:[00000030h] 3_2_011DB02A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01294015 mov eax, dword ptr fs:[00000030h] 3_2_01294015
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01294015 mov eax, dword ptr fs:[00000030h] 3_2_01294015
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E0050 mov eax, dword ptr fs:[00000030h] 3_2_011E0050
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E0050 mov eax, dword ptr fs:[00000030h] 3_2_011E0050
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01282073 mov eax, dword ptr fs:[00000030h] 3_2_01282073
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01291074 mov eax, dword ptr fs:[00000030h] 3_2_01291074
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012090AF mov eax, dword ptr fs:[00000030h] 3_2_012090AF
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C9080 mov eax, dword ptr fs:[00000030h] 3_2_011C9080
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FF0BF mov ecx, dword ptr fs:[00000030h] 3_2_011FF0BF
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FF0BF mov eax, dword ptr fs:[00000030h] 3_2_011FF0BF
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FF0BF mov eax, dword ptr fs:[00000030h] 3_2_011FF0BF
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01243884 mov eax, dword ptr fs:[00000030h] 3_2_01243884
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01243884 mov eax, dword ptr fs:[00000030h] 3_2_01243884
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F20A0 mov eax, dword ptr fs:[00000030h] 3_2_011F20A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F20A0 mov eax, dword ptr fs:[00000030h] 3_2_011F20A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F20A0 mov eax, dword ptr fs:[00000030h] 3_2_011F20A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F20A0 mov eax, dword ptr fs:[00000030h] 3_2_011F20A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F20A0 mov eax, dword ptr fs:[00000030h] 3_2_011F20A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F20A0 mov eax, dword ptr fs:[00000030h] 3_2_011F20A0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C58EC mov eax, dword ptr fs:[00000030h] 3_2_011C58EC
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0125B8D0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125B8D0 mov ecx, dword ptr fs:[00000030h] 3_2_0125B8D0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0125B8D0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0125B8D0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0125B8D0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125B8D0 mov eax, dword ptr fs:[00000030h] 3_2_0125B8D0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128131B mov eax, dword ptr fs:[00000030h] 3_2_0128131B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CF358 mov eax, dword ptr fs:[00000030h] 3_2_011CF358
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CDB40 mov eax, dword ptr fs:[00000030h] 3_2_011CDB40
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F3B7A mov eax, dword ptr fs:[00000030h] 3_2_011F3B7A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F3B7A mov eax, dword ptr fs:[00000030h] 3_2_011F3B7A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01298B58 mov eax, dword ptr fs:[00000030h] 3_2_01298B58
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CDB60 mov ecx, dword ptr fs:[00000030h] 3_2_011CDB60
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2397 mov eax, dword ptr fs:[00000030h] 3_2_011F2397
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01295BA5 mov eax, dword ptr fs:[00000030h] 3_2_01295BA5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FB390 mov eax, dword ptr fs:[00000030h] 3_2_011FB390
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D1B8F mov eax, dword ptr fs:[00000030h] 3_2_011D1B8F
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D1B8F mov eax, dword ptr fs:[00000030h] 3_2_011D1B8F
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128138A mov eax, dword ptr fs:[00000030h] 3_2_0128138A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0127D380 mov ecx, dword ptr fs:[00000030h] 3_2_0127D380
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F4BAD mov eax, dword ptr fs:[00000030h] 3_2_011F4BAD
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F4BAD mov eax, dword ptr fs:[00000030h] 3_2_011F4BAD
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F4BAD mov eax, dword ptr fs:[00000030h] 3_2_011F4BAD
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012453CA mov eax, dword ptr fs:[00000030h] 3_2_012453CA
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012453CA mov eax, dword ptr fs:[00000030h] 3_2_012453CA
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EDBE9 mov eax, dword ptr fs:[00000030h] 3_2_011EDBE9
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F03E2 mov eax, dword ptr fs:[00000030h] 3_2_011F03E2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F03E2 mov eax, dword ptr fs:[00000030h] 3_2_011F03E2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F03E2 mov eax, dword ptr fs:[00000030h] 3_2_011F03E2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F03E2 mov eax, dword ptr fs:[00000030h] 3_2_011F03E2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F03E2 mov eax, dword ptr fs:[00000030h] 3_2_011F03E2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F03E2 mov eax, dword ptr fs:[00000030h] 3_2_011F03E2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E3A1C mov eax, dword ptr fs:[00000030h] 3_2_011E3A1C
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CAA16 mov eax, dword ptr fs:[00000030h] 3_2_011CAA16
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CAA16 mov eax, dword ptr fs:[00000030h] 3_2_011CAA16
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01204A2C mov eax, dword ptr fs:[00000030h] 3_2_01204A2C
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01204A2C mov eax, dword ptr fs:[00000030h] 3_2_01204A2C
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C5210 mov eax, dword ptr fs:[00000030h] 3_2_011C5210
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C5210 mov ecx, dword ptr fs:[00000030h] 3_2_011C5210
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C5210 mov eax, dword ptr fs:[00000030h] 3_2_011C5210
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C5210 mov eax, dword ptr fs:[00000030h] 3_2_011C5210
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D8A0A mov eax, dword ptr fs:[00000030h] 3_2_011D8A0A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0127B260 mov eax, dword ptr fs:[00000030h] 3_2_0127B260
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0127B260 mov eax, dword ptr fs:[00000030h] 3_2_0127B260
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01298A62 mov eax, dword ptr fs:[00000030h] 3_2_01298A62
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0120927A mov eax, dword ptr fs:[00000030h] 3_2_0120927A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C9240 mov eax, dword ptr fs:[00000030h] 3_2_011C9240
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C9240 mov eax, dword ptr fs:[00000030h] 3_2_011C9240
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C9240 mov eax, dword ptr fs:[00000030h] 3_2_011C9240
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C9240 mov eax, dword ptr fs:[00000030h] 3_2_011C9240
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01254257 mov eax, dword ptr fs:[00000030h] 3_2_01254257
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128EA55 mov eax, dword ptr fs:[00000030h] 3_2_0128EA55
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FD294 mov eax, dword ptr fs:[00000030h] 3_2_011FD294
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FD294 mov eax, dword ptr fs:[00000030h] 3_2_011FD294
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DAAB0 mov eax, dword ptr fs:[00000030h] 3_2_011DAAB0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DAAB0 mov eax, dword ptr fs:[00000030h] 3_2_011DAAB0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FFAB0 mov eax, dword ptr fs:[00000030h] 3_2_011FFAB0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C52A5 mov eax, dword ptr fs:[00000030h] 3_2_011C52A5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C52A5 mov eax, dword ptr fs:[00000030h] 3_2_011C52A5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C52A5 mov eax, dword ptr fs:[00000030h] 3_2_011C52A5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C52A5 mov eax, dword ptr fs:[00000030h] 3_2_011C52A5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C52A5 mov eax, dword ptr fs:[00000030h] 3_2_011C52A5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2ACB mov eax, dword ptr fs:[00000030h] 3_2_011F2ACB
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2AE4 mov eax, dword ptr fs:[00000030h] 3_2_011F2AE4
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128E539 mov eax, dword ptr fs:[00000030h] 3_2_0128E539
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0124A537 mov eax, dword ptr fs:[00000030h] 3_2_0124A537
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01298D34 mov eax, dword ptr fs:[00000030h] 3_2_01298D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F4D3B mov eax, dword ptr fs:[00000030h] 3_2_011F4D3B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F4D3B mov eax, dword ptr fs:[00000030h] 3_2_011F4D3B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F4D3B mov eax, dword ptr fs:[00000030h] 3_2_011F4D3B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D3D34 mov eax, dword ptr fs:[00000030h] 3_2_011D3D34
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CAD30 mov eax, dword ptr fs:[00000030h] 3_2_011CAD30
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E7D50 mov eax, dword ptr fs:[00000030h] 3_2_011E7D50
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01203D43 mov eax, dword ptr fs:[00000030h] 3_2_01203D43
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01243540 mov eax, dword ptr fs:[00000030h] 3_2_01243540
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EC577 mov eax, dword ptr fs:[00000030h] 3_2_011EC577
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EC577 mov eax, dword ptr fs:[00000030h] 3_2_011EC577
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FFD9B mov eax, dword ptr fs:[00000030h] 3_2_011FFD9B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FFD9B mov eax, dword ptr fs:[00000030h] 3_2_011FFD9B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012905AC mov eax, dword ptr fs:[00000030h] 3_2_012905AC
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012905AC mov eax, dword ptr fs:[00000030h] 3_2_012905AC
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C2D8A mov eax, dword ptr fs:[00000030h] 3_2_011C2D8A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C2D8A mov eax, dword ptr fs:[00000030h] 3_2_011C2D8A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C2D8A mov eax, dword ptr fs:[00000030h] 3_2_011C2D8A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C2D8A mov eax, dword ptr fs:[00000030h] 3_2_011C2D8A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C2D8A mov eax, dword ptr fs:[00000030h] 3_2_011C2D8A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2581 mov eax, dword ptr fs:[00000030h] 3_2_011F2581
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2581 mov eax, dword ptr fs:[00000030h] 3_2_011F2581
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2581 mov eax, dword ptr fs:[00000030h] 3_2_011F2581
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F2581 mov eax, dword ptr fs:[00000030h] 3_2_011F2581
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F1DB5 mov eax, dword ptr fs:[00000030h] 3_2_011F1DB5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F1DB5 mov eax, dword ptr fs:[00000030h] 3_2_011F1DB5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F1DB5 mov eax, dword ptr fs:[00000030h] 3_2_011F1DB5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F35A1 mov eax, dword ptr fs:[00000030h] 3_2_011F35A1
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128FDE2 mov eax, dword ptr fs:[00000030h] 3_2_0128FDE2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128FDE2 mov eax, dword ptr fs:[00000030h] 3_2_0128FDE2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128FDE2 mov eax, dword ptr fs:[00000030h] 3_2_0128FDE2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128FDE2 mov eax, dword ptr fs:[00000030h] 3_2_0128FDE2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01278DF1 mov eax, dword ptr fs:[00000030h] 3_2_01278DF1
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246DC9 mov eax, dword ptr fs:[00000030h] 3_2_01246DC9
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246DC9 mov eax, dword ptr fs:[00000030h] 3_2_01246DC9
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246DC9 mov eax, dword ptr fs:[00000030h] 3_2_01246DC9
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246DC9 mov ecx, dword ptr fs:[00000030h] 3_2_01246DC9
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246DC9 mov eax, dword ptr fs:[00000030h] 3_2_01246DC9
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246DC9 mov eax, dword ptr fs:[00000030h] 3_2_01246DC9
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DD5E0 mov eax, dword ptr fs:[00000030h] 3_2_011DD5E0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DD5E0 mov eax, dword ptr fs:[00000030h] 3_2_011DD5E0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0129740D mov eax, dword ptr fs:[00000030h] 3_2_0129740D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0129740D mov eax, dword ptr fs:[00000030h] 3_2_0129740D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0129740D mov eax, dword ptr fs:[00000030h] 3_2_0129740D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281C06 mov eax, dword ptr fs:[00000030h] 3_2_01281C06
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246C0A mov eax, dword ptr fs:[00000030h] 3_2_01246C0A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246C0A mov eax, dword ptr fs:[00000030h] 3_2_01246C0A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246C0A mov eax, dword ptr fs:[00000030h] 3_2_01246C0A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246C0A mov eax, dword ptr fs:[00000030h] 3_2_01246C0A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FBC2C mov eax, dword ptr fs:[00000030h] 3_2_011FBC2C
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FA44B mov eax, dword ptr fs:[00000030h] 3_2_011FA44B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011E746D mov eax, dword ptr fs:[00000030h] 3_2_011E746D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125C450 mov eax, dword ptr fs:[00000030h] 3_2_0125C450
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125C450 mov eax, dword ptr fs:[00000030h] 3_2_0125C450
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D849B mov eax, dword ptr fs:[00000030h] 3_2_011D849B
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012814FB mov eax, dword ptr fs:[00000030h] 3_2_012814FB
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246CF0 mov eax, dword ptr fs:[00000030h] 3_2_01246CF0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246CF0 mov eax, dword ptr fs:[00000030h] 3_2_01246CF0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01246CF0 mov eax, dword ptr fs:[00000030h] 3_2_01246CF0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01298CD6 mov eax, dword ptr fs:[00000030h] 3_2_01298CD6
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EF716 mov eax, dword ptr fs:[00000030h] 3_2_011EF716
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FA70E mov eax, dword ptr fs:[00000030h] 3_2_011FA70E
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FA70E mov eax, dword ptr fs:[00000030h] 3_2_011FA70E
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0129070D mov eax, dword ptr fs:[00000030h] 3_2_0129070D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0129070D mov eax, dword ptr fs:[00000030h] 3_2_0129070D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FE730 mov eax, dword ptr fs:[00000030h] 3_2_011FE730
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C4F2E mov eax, dword ptr fs:[00000030h] 3_2_011C4F2E
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011C4F2E mov eax, dword ptr fs:[00000030h] 3_2_011C4F2E
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125FF10 mov eax, dword ptr fs:[00000030h] 3_2_0125FF10
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125FF10 mov eax, dword ptr fs:[00000030h] 3_2_0125FF10
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01298F6A mov eax, dword ptr fs:[00000030h] 3_2_01298F6A
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DEF40 mov eax, dword ptr fs:[00000030h] 3_2_011DEF40
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011DFF60 mov eax, dword ptr fs:[00000030h] 3_2_011DFF60
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D8794 mov eax, dword ptr fs:[00000030h] 3_2_011D8794
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01247794 mov eax, dword ptr fs:[00000030h] 3_2_01247794
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01247794 mov eax, dword ptr fs:[00000030h] 3_2_01247794
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01247794 mov eax, dword ptr fs:[00000030h] 3_2_01247794
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012037F5 mov eax, dword ptr fs:[00000030h] 3_2_012037F5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FA61C mov eax, dword ptr fs:[00000030h] 3_2_011FA61C
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011FA61C mov eax, dword ptr fs:[00000030h] 3_2_011FA61C
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0127FE3F mov eax, dword ptr fs:[00000030h] 3_2_0127FE3F
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CC600 mov eax, dword ptr fs:[00000030h] 3_2_011CC600
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CC600 mov eax, dword ptr fs:[00000030h] 3_2_011CC600
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CC600 mov eax, dword ptr fs:[00000030h] 3_2_011CC600
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F8E00 mov eax, dword ptr fs:[00000030h] 3_2_011F8E00
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01281608 mov eax, dword ptr fs:[00000030h] 3_2_01281608
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011CE620 mov eax, dword ptr fs:[00000030h] 3_2_011CE620
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D7E41 mov eax, dword ptr fs:[00000030h] 3_2_011D7E41
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D7E41 mov eax, dword ptr fs:[00000030h] 3_2_011D7E41
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D7E41 mov eax, dword ptr fs:[00000030h] 3_2_011D7E41
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D7E41 mov eax, dword ptr fs:[00000030h] 3_2_011D7E41
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D7E41 mov eax, dword ptr fs:[00000030h] 3_2_011D7E41
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D7E41 mov eax, dword ptr fs:[00000030h] 3_2_011D7E41
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128AE44 mov eax, dword ptr fs:[00000030h] 3_2_0128AE44
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0128AE44 mov eax, dword ptr fs:[00000030h] 3_2_0128AE44
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EAE73 mov eax, dword ptr fs:[00000030h] 3_2_011EAE73
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EAE73 mov eax, dword ptr fs:[00000030h] 3_2_011EAE73
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EAE73 mov eax, dword ptr fs:[00000030h] 3_2_011EAE73
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EAE73 mov eax, dword ptr fs:[00000030h] 3_2_011EAE73
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011EAE73 mov eax, dword ptr fs:[00000030h] 3_2_011EAE73
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D766D mov eax, dword ptr fs:[00000030h] 3_2_011D766D
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_012446A7 mov eax, dword ptr fs:[00000030h] 3_2_012446A7
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01290EA5 mov eax, dword ptr fs:[00000030h] 3_2_01290EA5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01290EA5 mov eax, dword ptr fs:[00000030h] 3_2_01290EA5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01290EA5 mov eax, dword ptr fs:[00000030h] 3_2_01290EA5
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0125FE87 mov eax, dword ptr fs:[00000030h] 3_2_0125FE87
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F36CC mov eax, dword ptr fs:[00000030h] 3_2_011F36CC
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0127FEC0 mov eax, dword ptr fs:[00000030h] 3_2_0127FEC0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01208EC7 mov eax, dword ptr fs:[00000030h] 3_2_01208EC7
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011D76E2 mov eax, dword ptr fs:[00000030h] 3_2_011D76E2
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_01298ED6 mov eax, dword ptr fs:[00000030h] 3_2_01298ED6
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_011F16E0 mov ecx, dword ptr fs:[00000030h] 3_2_011F16E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA90AF mov eax, dword ptr fs:[00000030h] 8_2_00AA90AF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A920A0 mov eax, dword ptr fs:[00000030h] 8_2_00A920A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A920A0 mov eax, dword ptr fs:[00000030h] 8_2_00A920A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A920A0 mov eax, dword ptr fs:[00000030h] 8_2_00A920A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A920A0 mov eax, dword ptr fs:[00000030h] 8_2_00A920A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A920A0 mov eax, dword ptr fs:[00000030h] 8_2_00A920A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A920A0 mov eax, dword ptr fs:[00000030h] 8_2_00A920A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9F0BF mov ecx, dword ptr fs:[00000030h] 8_2_00A9F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9F0BF mov eax, dword ptr fs:[00000030h] 8_2_00A9F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9F0BF mov eax, dword ptr fs:[00000030h] 8_2_00A9F0BF
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A69080 mov eax, dword ptr fs:[00000030h] 8_2_00A69080
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE3884 mov eax, dword ptr fs:[00000030h] 8_2_00AE3884
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE3884 mov eax, dword ptr fs:[00000030h] 8_2_00AE3884
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A658EC mov eax, dword ptr fs:[00000030h] 8_2_00A658EC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFB8D0 mov eax, dword ptr fs:[00000030h] 8_2_00AFB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFB8D0 mov ecx, dword ptr fs:[00000030h] 8_2_00AFB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFB8D0 mov eax, dword ptr fs:[00000030h] 8_2_00AFB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFB8D0 mov eax, dword ptr fs:[00000030h] 8_2_00AFB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFB8D0 mov eax, dword ptr fs:[00000030h] 8_2_00AFB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFB8D0 mov eax, dword ptr fs:[00000030h] 8_2_00AFB8D0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9002D mov eax, dword ptr fs:[00000030h] 8_2_00A9002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9002D mov eax, dword ptr fs:[00000030h] 8_2_00A9002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9002D mov eax, dword ptr fs:[00000030h] 8_2_00A9002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9002D mov eax, dword ptr fs:[00000030h] 8_2_00A9002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9002D mov eax, dword ptr fs:[00000030h] 8_2_00A9002D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7B02A mov eax, dword ptr fs:[00000030h] 8_2_00A7B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7B02A mov eax, dword ptr fs:[00000030h] 8_2_00A7B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7B02A mov eax, dword ptr fs:[00000030h] 8_2_00A7B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7B02A mov eax, dword ptr fs:[00000030h] 8_2_00A7B02A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B34015 mov eax, dword ptr fs:[00000030h] 8_2_00B34015
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B34015 mov eax, dword ptr fs:[00000030h] 8_2_00B34015
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE7016 mov eax, dword ptr fs:[00000030h] 8_2_00AE7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE7016 mov eax, dword ptr fs:[00000030h] 8_2_00AE7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE7016 mov eax, dword ptr fs:[00000030h] 8_2_00AE7016
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B22073 mov eax, dword ptr fs:[00000030h] 8_2_00B22073
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B31074 mov eax, dword ptr fs:[00000030h] 8_2_00B31074
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A80050 mov eax, dword ptr fs:[00000030h] 8_2_00A80050
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A80050 mov eax, dword ptr fs:[00000030h] 8_2_00A80050
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE69A6 mov eax, dword ptr fs:[00000030h] 8_2_00AE69A6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A961A0 mov eax, dword ptr fs:[00000030h] 8_2_00A961A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A961A0 mov eax, dword ptr fs:[00000030h] 8_2_00A961A0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE51BE mov eax, dword ptr fs:[00000030h] 8_2_00AE51BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE51BE mov eax, dword ptr fs:[00000030h] 8_2_00AE51BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE51BE mov eax, dword ptr fs:[00000030h] 8_2_00AE51BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE51BE mov eax, dword ptr fs:[00000030h] 8_2_00AE51BE
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A8C182 mov eax, dword ptr fs:[00000030h] 8_2_00A8C182
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9A185 mov eax, dword ptr fs:[00000030h] 8_2_00A9A185
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92990 mov eax, dword ptr fs:[00000030h] 8_2_00A92990
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AF41E8 mov eax, dword ptr fs:[00000030h] 8_2_00AF41E8
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6B1E1 mov eax, dword ptr fs:[00000030h] 8_2_00A6B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6B1E1 mov eax, dword ptr fs:[00000030h] 8_2_00A6B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6B1E1 mov eax, dword ptr fs:[00000030h] 8_2_00A6B1E1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A84120 mov eax, dword ptr fs:[00000030h] 8_2_00A84120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A84120 mov eax, dword ptr fs:[00000030h] 8_2_00A84120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A84120 mov eax, dword ptr fs:[00000030h] 8_2_00A84120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A84120 mov eax, dword ptr fs:[00000030h] 8_2_00A84120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A84120 mov ecx, dword ptr fs:[00000030h] 8_2_00A84120
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9513A mov eax, dword ptr fs:[00000030h] 8_2_00A9513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9513A mov eax, dword ptr fs:[00000030h] 8_2_00A9513A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A69100 mov eax, dword ptr fs:[00000030h] 8_2_00A69100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A69100 mov eax, dword ptr fs:[00000030h] 8_2_00A69100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A69100 mov eax, dword ptr fs:[00000030h] 8_2_00A69100
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6C962 mov eax, dword ptr fs:[00000030h] 8_2_00A6C962
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6B171 mov eax, dword ptr fs:[00000030h] 8_2_00A6B171
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6B171 mov eax, dword ptr fs:[00000030h] 8_2_00A6B171
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A8B944 mov eax, dword ptr fs:[00000030h] 8_2_00A8B944
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A8B944 mov eax, dword ptr fs:[00000030h] 8_2_00A8B944
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A652A5 mov eax, dword ptr fs:[00000030h] 8_2_00A652A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A652A5 mov eax, dword ptr fs:[00000030h] 8_2_00A652A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A652A5 mov eax, dword ptr fs:[00000030h] 8_2_00A652A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A652A5 mov eax, dword ptr fs:[00000030h] 8_2_00A652A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A652A5 mov eax, dword ptr fs:[00000030h] 8_2_00A652A5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7AAB0 mov eax, dword ptr fs:[00000030h] 8_2_00A7AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7AAB0 mov eax, dword ptr fs:[00000030h] 8_2_00A7AAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9FAB0 mov eax, dword ptr fs:[00000030h] 8_2_00A9FAB0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9D294 mov eax, dword ptr fs:[00000030h] 8_2_00A9D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9D294 mov eax, dword ptr fs:[00000030h] 8_2_00A9D294
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92AE4 mov eax, dword ptr fs:[00000030h] 8_2_00A92AE4
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92ACB mov eax, dword ptr fs:[00000030h] 8_2_00A92ACB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA4A2C mov eax, dword ptr fs:[00000030h] 8_2_00AA4A2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA4A2C mov eax, dword ptr fs:[00000030h] 8_2_00AA4A2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2AA16 mov eax, dword ptr fs:[00000030h] 8_2_00B2AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2AA16 mov eax, dword ptr fs:[00000030h] 8_2_00B2AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A78A0A mov eax, dword ptr fs:[00000030h] 8_2_00A78A0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6AA16 mov eax, dword ptr fs:[00000030h] 8_2_00A6AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6AA16 mov eax, dword ptr fs:[00000030h] 8_2_00A6AA16
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A83A1C mov eax, dword ptr fs:[00000030h] 8_2_00A83A1C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A65210 mov eax, dword ptr fs:[00000030h] 8_2_00A65210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A65210 mov ecx, dword ptr fs:[00000030h] 8_2_00A65210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A65210 mov eax, dword ptr fs:[00000030h] 8_2_00A65210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A65210 mov eax, dword ptr fs:[00000030h] 8_2_00A65210
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA927A mov eax, dword ptr fs:[00000030h] 8_2_00AA927A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B1B260 mov eax, dword ptr fs:[00000030h] 8_2_00B1B260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B1B260 mov eax, dword ptr fs:[00000030h] 8_2_00B1B260
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B38A62 mov eax, dword ptr fs:[00000030h] 8_2_00B38A62
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A69240 mov eax, dword ptr fs:[00000030h] 8_2_00A69240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A69240 mov eax, dword ptr fs:[00000030h] 8_2_00A69240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A69240 mov eax, dword ptr fs:[00000030h] 8_2_00A69240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A69240 mov eax, dword ptr fs:[00000030h] 8_2_00A69240
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2EA55 mov eax, dword ptr fs:[00000030h] 8_2_00B2EA55
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AF4257 mov eax, dword ptr fs:[00000030h] 8_2_00AF4257
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A94BAD mov eax, dword ptr fs:[00000030h] 8_2_00A94BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A94BAD mov eax, dword ptr fs:[00000030h] 8_2_00A94BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A94BAD mov eax, dword ptr fs:[00000030h] 8_2_00A94BAD
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B35BA5 mov eax, dword ptr fs:[00000030h] 8_2_00B35BA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A71B8F mov eax, dword ptr fs:[00000030h] 8_2_00A71B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A71B8F mov eax, dword ptr fs:[00000030h] 8_2_00A71B8F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B1D380 mov ecx, dword ptr fs:[00000030h] 8_2_00B1D380
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2138A mov eax, dword ptr fs:[00000030h] 8_2_00B2138A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9B390 mov eax, dword ptr fs:[00000030h] 8_2_00A9B390
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92397 mov eax, dword ptr fs:[00000030h] 8_2_00A92397
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A8DBE9 mov eax, dword ptr fs:[00000030h] 8_2_00A8DBE9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A903E2 mov eax, dword ptr fs:[00000030h] 8_2_00A903E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A903E2 mov eax, dword ptr fs:[00000030h] 8_2_00A903E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A903E2 mov eax, dword ptr fs:[00000030h] 8_2_00A903E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A903E2 mov eax, dword ptr fs:[00000030h] 8_2_00A903E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A903E2 mov eax, dword ptr fs:[00000030h] 8_2_00A903E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A903E2 mov eax, dword ptr fs:[00000030h] 8_2_00A903E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE53CA mov eax, dword ptr fs:[00000030h] 8_2_00AE53CA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE53CA mov eax, dword ptr fs:[00000030h] 8_2_00AE53CA
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2131B mov eax, dword ptr fs:[00000030h] 8_2_00B2131B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6DB60 mov ecx, dword ptr fs:[00000030h] 8_2_00A6DB60
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A93B7A mov eax, dword ptr fs:[00000030h] 8_2_00A93B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A93B7A mov eax, dword ptr fs:[00000030h] 8_2_00A93B7A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6DB40 mov eax, dword ptr fs:[00000030h] 8_2_00A6DB40
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B38B58 mov eax, dword ptr fs:[00000030h] 8_2_00B38B58
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6F358 mov eax, dword ptr fs:[00000030h] 8_2_00A6F358
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7849B mov eax, dword ptr fs:[00000030h] 8_2_00A7849B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B214FB mov eax, dword ptr fs:[00000030h] 8_2_00B214FB
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6CF0 mov eax, dword ptr fs:[00000030h] 8_2_00AE6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6CF0 mov eax, dword ptr fs:[00000030h] 8_2_00AE6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6CF0 mov eax, dword ptr fs:[00000030h] 8_2_00AE6CF0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B38CD6 mov eax, dword ptr fs:[00000030h] 8_2_00B38CD6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9BC2C mov eax, dword ptr fs:[00000030h] 8_2_00A9BC2C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6C0A mov eax, dword ptr fs:[00000030h] 8_2_00AE6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6C0A mov eax, dword ptr fs:[00000030h] 8_2_00AE6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6C0A mov eax, dword ptr fs:[00000030h] 8_2_00AE6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6C0A mov eax, dword ptr fs:[00000030h] 8_2_00AE6C0A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21C06 mov eax, dword ptr fs:[00000030h] 8_2_00B21C06
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B3740D mov eax, dword ptr fs:[00000030h] 8_2_00B3740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B3740D mov eax, dword ptr fs:[00000030h] 8_2_00B3740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B3740D mov eax, dword ptr fs:[00000030h] 8_2_00B3740D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A8746D mov eax, dword ptr fs:[00000030h] 8_2_00A8746D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9A44B mov eax, dword ptr fs:[00000030h] 8_2_00A9A44B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFC450 mov eax, dword ptr fs:[00000030h] 8_2_00AFC450
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFC450 mov eax, dword ptr fs:[00000030h] 8_2_00AFC450
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A935A1 mov eax, dword ptr fs:[00000030h] 8_2_00A935A1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A91DB5 mov eax, dword ptr fs:[00000030h] 8_2_00A91DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A91DB5 mov eax, dword ptr fs:[00000030h] 8_2_00A91DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A91DB5 mov eax, dword ptr fs:[00000030h] 8_2_00A91DB5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B305AC mov eax, dword ptr fs:[00000030h] 8_2_00B305AC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B305AC mov eax, dword ptr fs:[00000030h] 8_2_00B305AC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92581 mov eax, dword ptr fs:[00000030h] 8_2_00A92581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92581 mov eax, dword ptr fs:[00000030h] 8_2_00A92581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92581 mov eax, dword ptr fs:[00000030h] 8_2_00A92581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A92581 mov eax, dword ptr fs:[00000030h] 8_2_00A92581
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A62D8A mov eax, dword ptr fs:[00000030h] 8_2_00A62D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A62D8A mov eax, dword ptr fs:[00000030h] 8_2_00A62D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A62D8A mov eax, dword ptr fs:[00000030h] 8_2_00A62D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A62D8A mov eax, dword ptr fs:[00000030h] 8_2_00A62D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A62D8A mov eax, dword ptr fs:[00000030h] 8_2_00A62D8A
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9FD9B mov eax, dword ptr fs:[00000030h] 8_2_00A9FD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9FD9B mov eax, dword ptr fs:[00000030h] 8_2_00A9FD9B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B18DF1 mov eax, dword ptr fs:[00000030h] 8_2_00B18DF1
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7D5E0 mov eax, dword ptr fs:[00000030h] 8_2_00A7D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7D5E0 mov eax, dword ptr fs:[00000030h] 8_2_00A7D5E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2FDE2 mov eax, dword ptr fs:[00000030h] 8_2_00B2FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2FDE2 mov eax, dword ptr fs:[00000030h] 8_2_00B2FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2FDE2 mov eax, dword ptr fs:[00000030h] 8_2_00B2FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2FDE2 mov eax, dword ptr fs:[00000030h] 8_2_00B2FDE2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6DC9 mov eax, dword ptr fs:[00000030h] 8_2_00AE6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6DC9 mov eax, dword ptr fs:[00000030h] 8_2_00AE6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6DC9 mov eax, dword ptr fs:[00000030h] 8_2_00AE6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6DC9 mov ecx, dword ptr fs:[00000030h] 8_2_00AE6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6DC9 mov eax, dword ptr fs:[00000030h] 8_2_00AE6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE6DC9 mov eax, dword ptr fs:[00000030h] 8_2_00AE6DC9
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B38D34 mov eax, dword ptr fs:[00000030h] 8_2_00B38D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B2E539 mov eax, dword ptr fs:[00000030h] 8_2_00B2E539
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A94D3B mov eax, dword ptr fs:[00000030h] 8_2_00A94D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A94D3B mov eax, dword ptr fs:[00000030h] 8_2_00A94D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A94D3B mov eax, dword ptr fs:[00000030h] 8_2_00A94D3B
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A73D34 mov eax, dword ptr fs:[00000030h] 8_2_00A73D34
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6AD30 mov eax, dword ptr fs:[00000030h] 8_2_00A6AD30
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AEA537 mov eax, dword ptr fs:[00000030h] 8_2_00AEA537
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A8C577 mov eax, dword ptr fs:[00000030h] 8_2_00A8C577
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A8C577 mov eax, dword ptr fs:[00000030h] 8_2_00A8C577
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA3D43 mov eax, dword ptr fs:[00000030h] 8_2_00AA3D43
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE3540 mov eax, dword ptr fs:[00000030h] 8_2_00AE3540
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A87D50 mov eax, dword ptr fs:[00000030h] 8_2_00A87D50
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AE46A7 mov eax, dword ptr fs:[00000030h] 8_2_00AE46A7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B30EA5 mov eax, dword ptr fs:[00000030h] 8_2_00B30EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B30EA5 mov eax, dword ptr fs:[00000030h] 8_2_00B30EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B30EA5 mov eax, dword ptr fs:[00000030h] 8_2_00B30EA5
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AFFE87 mov eax, dword ptr fs:[00000030h] 8_2_00AFFE87
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A776E2 mov eax, dword ptr fs:[00000030h] 8_2_00A776E2
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A916E0 mov ecx, dword ptr fs:[00000030h] 8_2_00A916E0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B38ED6 mov eax, dword ptr fs:[00000030h] 8_2_00B38ED6
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A936CC mov eax, dword ptr fs:[00000030h] 8_2_00A936CC
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00AA8EC7 mov eax, dword ptr fs:[00000030h] 8_2_00AA8EC7
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B1FEC0 mov eax, dword ptr fs:[00000030h] 8_2_00B1FEC0
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6E620 mov eax, dword ptr fs:[00000030h] 8_2_00A6E620
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B1FE3F mov eax, dword ptr fs:[00000030h] 8_2_00B1FE3F
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6C600 mov eax, dword ptr fs:[00000030h] 8_2_00A6C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6C600 mov eax, dword ptr fs:[00000030h] 8_2_00A6C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A6C600 mov eax, dword ptr fs:[00000030h] 8_2_00A6C600
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A98E00 mov eax, dword ptr fs:[00000030h] 8_2_00A98E00
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9A61C mov eax, dword ptr fs:[00000030h] 8_2_00A9A61C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A9A61C mov eax, dword ptr fs:[00000030h] 8_2_00A9A61C
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00B21608 mov eax, dword ptr fs:[00000030h] 8_2_00B21608
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A7766D mov eax, dword ptr fs:[00000030h] 8_2_00A7766D
Source: C:\Windows\SysWOW64\NETSTAT.EXE Code function: 8_2_00A8AE73 mov eax, dword ptr fs:[00000030h] 8_2_00A8AE73
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Code function: 3_2_0040ACE0 LdrLoadDll, 3_2_0040ACE0
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Memory allocated: page read and write | page guard Jump to behavior

HIPS / PFW / Operating System Protection Evasion:

barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Network Connect: 170.130.100.87 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.yemdzosports.com
Source: C:\Windows\explorer.exe Domain query: www.cyfarthfa.net
Source: C:\Windows\explorer.exe Network Connect: 81.17.29.148 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.mychmedicare.com
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Section unmapped: C:\Windows\SysWOW64\NETSTAT.EXE base address: 1290000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Section loaded: unknown target: C:\Windows\SysWOW64\NETSTAT.EXE protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Memory written: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Thread register set: target process: 3352 Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Thread register set: target process: 3352 Jump to behavior
Adds a directory exclusion to Windows Defender
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process created: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Process created: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Jump to behavior
Source: C:\Windows\SysWOW64\NETSTAT.EXE Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe" Jump to behavior
Source: explorer.exe, 00000005.00000000.337019008.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.319037996.0000000000B68000.00000004.00000020.sdmp, explorer.exe, 00000005.00000000.301038140.0000000000B68000.00000004.00000020.sdmp Binary or memory string: Progman\Pr
Source: explorer.exe, 00000005.00000000.319590961.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.301751773.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.337267048.00000000011E0000.00000002.00020000.sdmp, NETSTAT.EXE, 00000008.00000002.555221751.0000000004000000.00000002.00020000.sdmp Binary or memory string: Program Manager
Source: explorer.exe, 00000005.00000000.306138972.0000000005E10000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.319590961.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.301751773.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.337267048.00000000011E0000.00000002.00020000.sdmp, NETSTAT.EXE, 00000008.00000002.555221751.0000000004000000.00000002.00020000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.319590961.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.301751773.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.337267048.00000000011E0000.00000002.00020000.sdmp, NETSTAT.EXE, 00000008.00000002.555221751.0000000004000000.00000002.00020000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000005.00000000.319590961.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.301751773.00000000011E0000.00000002.00020000.sdmp, explorer.exe, 00000005.00000000.337267048.00000000011E0000.00000002.00020000.sdmp, NETSTAT.EXE, 00000008.00000002.555221751.0000000004000000.00000002.00020000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.310991311.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.344554883.0000000008778000.00000004.00000001.sdmp, explorer.exe, 00000005.00000000.329782566.0000000008778000.00000004.00000001.sdmp Binary or memory string: Shell_TrayWndh

Language, Device and Operating System Detection:

barindex
Queries the volume information (name, serial number etc) of a device
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.ConsoleHost\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.ConsoleHost.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management.Automation\v4.0_3.0.0.0__31bf3856ad364e35\System.Management.Automation.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Numerics\v4.0_4.0.0.0__b77a5c561934e089\System.Numerics.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.DirectoryServices\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.DirectoryServices.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Management\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Data\v4.0_4.0.0.0__b77a5c561934e089\System.Data.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Security\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Security.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\System.Transactions\v4.0_4.0.0.0__b77a5c561934e089\System.Transactions.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-GroupPolicy-ClientTools-WOW64-ds-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-AppManagement-AppV-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.Management.Infrastructure.Native\v4.0_1.0.0.0__31bf3856ad364e35\Microsoft.Management.Infrastructure.Native.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\AppvClient\Microsoft.AppV.AppVClientPowerShell.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_32\Microsoft.AppV.AppvClientComConsumer\v4.0_10.0.0.0__31bf3856ad364e35\Microsoft.AppV.AppvClientComConsumer.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-SecureStartup-Subsystem-WOW64-base-Package~31bf3856ad364e35~amd64~en-US~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Utility\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Utility.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Configuration.Install\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Configuration.Install.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\Modules\BitLocker\Microsoft.BitLocker.Structures.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Windows-Defender-Management-Powershell-Group-WOW64-Package~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.PowerShell.Commands.Management\v4.0_3.0.0.0__31bf3856ad364e35\Microsoft.PowerShell.Commands.Management.dll VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\ VolumeInformation Jump to behavior
Source: C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe Queries volume information: C:\Windows\System32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package00113~31bf3856ad364e35~amd64~~10.0.17134.1.cat VolumeInformation Jump to behavior
Source: C:\Users\user\Desktop\20211016-113459_Banco Cajamar.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid Jump to behavior

Stealing of Sensitive Information:

barindex
Yara detected FormBook
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.296459944.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.296910307.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.553599848.00000000006C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353139418.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353353026.0000000000C10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353654430.0000000000FA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.553890996.00000000008A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.302482435.0000000004094000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.332876311.0000000010339000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp, type: MEMORY

Remote Access Functionality:

barindex
Yara detected FormBook
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.8.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.20211016-113459_Banco Cajamar.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.20211016-113459_Banco Cajamar.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000008.00000002.553441786.0000000000140000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.296459944.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.296910307.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.553599848.00000000006C0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353139418.0000000000400000.00000040.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353353026.0000000000C10000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.353654430.0000000000FA0000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000008.00000002.553890996.00000000008A0000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.302482435.0000000004094000.00000004.00000001.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.332876311.0000000010339000.00000040.00020000.sdmp, type: MEMORY
Source: Yara match File source: 00000000.00000002.301459328.0000000003E61000.00000004.00000001.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 532899 Sample: 20211016-113459_Banco Cajamar.exe Startdate: 02/12/2021 Architecture: WINDOWS Score: 100 40 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->40 42 Multi AV Scanner detection for domain / URL 2->42 44 Found malware configuration 2->44 46 11 other signatures 2->46 10 20211016-113459_Banco Cajamar.exe 4 2->10         started        process3 file4 32 C:\...\20211016-113459_Banco Cajamar.exe.log, ASCII 10->32 dropped 60 Adds a directory exclusion to Windows Defender 10->60 62 Injects a PE file into a foreign processes 10->62 14 20211016-113459_Banco Cajamar.exe 10->14         started        17 powershell.exe 25 10->17         started        signatures5 process6 signatures7 64 Modifies the context of a thread in another process (thread injection) 14->64 66 Maps a DLL or memory area into another process 14->66 68 Sample uses process hollowing technique 14->68 70 Queues an APC in another process (thread injection) 14->70 19 explorer.exe 14->19 injected 23 conhost.exe 17->23         started        process8 dnsIp9 34 www.mychmedicare.com 81.17.29.148, 49768, 80 PLI-ASCH Switzerland 19->34 36 www.cyfarthfa.net 170.130.100.87, 49771, 80 EONIX-COMMUNICATIONS-ASBLOCK-62904US United States 19->36 38 www.yemdzosports.com 19->38 48 System process connects to network (likely due to code injection or exploit) 19->48 50 Uses netstat to query active network connections and open ports 19->50 25 NETSTAT.EXE 19->25         started        signatures10 process11 signatures12 52 Self deletion via cmd delete 25->52 54 Modifies the context of a thread in another process (thread injection) 25->54 56 Maps a DLL or memory area into another process 25->56 58 Tries to detect virtualization through RDTSC time measurements 25->58 28 cmd.exe 1 25->28         started        process13 process14 30 conhost.exe 28->30         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
170.130.100.87
 www.cyfarthfa.net United States
62904 EONIX-COMMUNICATIONS-ASBLOCK-62904US true
81.17.29.148
 www.mychmedicare.com Switzerland
51852 PLI-ASCH true

Contacted Domains

Name IP Active
www.cyfarthfa.net 170.130.100.87 true
www.mychmedicare.com 81.17.29.148 true
www.yemdzosports.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.etaiiler.com/n3p2/ true
  • 5%, Virustotal, Browse
  • Avira URL Cloud: malware
 low