Windows Analysis Report
new_order.exe

Overview

General Information

Sample Name: new_order.exe
Analysis ID: 562020
MD5: a0e70d1760e60d81e0f4ac2904fa8002
SHA1: 0512dcf545274ac6512abf3fb31a6fff41614280
SHA256: 0cd606362bbe747f3d0c0193675ce46ea2920fba28580b784f50a2969bbb0c27
Tags: exe
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Antivirus detection for URL or domain
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Initial sample is a PE file and has a suspicious name
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Self deletion via cmd delete
Injects a PE file into a foreign processes
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
May sleep (evasive loops) to hinder dynamic analysis
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Internet Provider seen in connection with other malware
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
HTTP GET or POST without a user agent
IP address seen in connection with other malware
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Sample file is different than original file name gathered from version info
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.foodgw.com/os16/"], "decoy": ["nautic-experts-hageboelling.com", "fullharvestfundraising.com", "xbdsm.club", "duocaterers.com", "prizebuddy.club", "nillprive.com", "firebreathingpenguin.com", "buxledger.com", "annual-journals.com", "mydemosite0.com", "noaoka.com", "eblaghe-iran.xyz", "globalyuncang.com", "jacqueson-autocars.com", "asiafinances.com", "howtomakearesume.space", "modernwarfaresecrets.com", "dualamaquinaria.com", "thrili.com", "gracing-up.com", "jcrealtydesigns.com", "southaustinmarket.com", "dp-yszxwbhc.com", "cryptolux.store", "yourtechyadda.com", "yogamat-turban.com", "fykori.xyz", "bitherders.com", "strelingcollectibles.com", "undershieldz.com", "youcarboneutral.com", "meetjaykinder.com", "wicked-smokes.com", "wy-bride.com", "dunespro.com", "sallyandterry.com", "theamalfiswim.com", "eleynworld.com", "dreamsinbloomphotography.com", "anaccommodation.com", "slingactivt.com", "rxd-ereecd.com", "immovableproperty.online", "ramziflowers.com", "anthropophony.com", "uncle.finance", "ialife.info", "kennascookies.com", "meta-medical.info", "sexcommittee.com", "royalfountainlogistics.com", "thedefinitionteam.store", "dragonflyessence.com", "momubeauty.com", "alraedest.com", "alcmjd.xyz", "massagecon.com", "nicoletian.com", "rapslearning.online", "dlapi.xyz", "52economics.com", "neurochirurgie-eisner.com", "mbbfocean.xyz", "greenlightiim.com"]}
Yara detected FormBook
Source: Yara match File source: 3.0.new_order.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.new_order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.new_order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.new_order.exe.1acb0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.new_order.exe.1acb0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946218609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946443311.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.738390030.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.754910561.00000000004C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.688696186.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.723911761.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946503989.0000000000850000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.687734511.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.754825305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.755193140.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Antivirus detection for URL or domain
Source: www.foodgw.com/os16/ Avira URL Cloud: Label: malware
Source: http://www.bitherders.com/os16/?XL3pvD=wD4cT7q48NFnhCndHw9GtexQ1GWRT95jx29TDgoZhFSVm5lLt3bl1PAkaHfi4RiaXjL3&m0Dd=nFQHcLg0mfV8fj Avira URL Cloud: Label: malware
Machine Learning detection for sample
Source: new_order.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 3.0.new_order.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 9.2.explorer.exe.4e0f840.3.unpack Avira: Label: TR/Patched.Ren.Gen
Source: 3.0.new_order.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.2.new_order.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 3.0.new_order.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.new_order.exe.1acb0000.2.unpack Avira: Label: TR/Crypt.ZPACK.Gen

Compliance
barindex
Uses 32bit PE files
Source: new_order.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Binary string: explorer.pdbUGP source: new_order.exe, 00000003.00000002.756328616.0000000002660000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: new_order.exe, 00000001.00000003.684420646.000000001AE80000.00000004.00000800.00020000.00000000.sdmp, new_order.exe, 00000001.00000003.688778251.000000001ACF0000.00000004.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000003.689848535.00000000006F0000.00000004.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000002.755436113.0000000000A30000.00000040.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000002.755889616.0000000000B4F000.00000040.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.947351653.00000000049FF000.00000040.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.947213320.00000000048E0000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: new_order.exe, new_order.exe, 00000003.00000003.689848535.00000000006F0000.00000004.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000002.755436113.0000000000A30000.00000040.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000002.755889616.0000000000B4F000.00000040.00000800.00020000.00000000.sdmp, explorer.exe, explorer.exe, 00000009.00000002.947351653.00000000049FF000.00000040.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.947213320.00000000048E0000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: explorer.pdb source: new_order.exe, 00000003.00000002.756328616.0000000002660000.00000040.10000000.00040000.00000000.sdmp
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00405D7C FindFirstFileA,FindClose, 1_2_00405D7C
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 1_2_004053AA
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00402630 FindFirstFileA, 1_2_00402630

Networking
barindex
Snort IDS alert for network traffic (e.g. based on Emerging Threat rules)
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49806 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49806 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49806 -> 34.102.136.180:80
Source: Traffic Snort IDS: 2031453 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49829 -> 3.64.163.50:80
Source: Traffic Snort IDS: 2031449 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49829 -> 3.64.163.50:80
Source: Traffic Snort IDS: 2031412 ET TROJAN FormBook CnC Checkin (GET) 192.168.2.4:49829 -> 3.64.163.50:80
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.royalfountainlogistics.com
Source: C:\Windows\explorer.exe Network Connect: 3.64.163.50 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.bitherders.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.foodgw.com/os16/
Internet Provider seen in connection with other malware
Source: Joe Sandbox View ASN Name: AMAZON-02US AMAZON-02US
HTTP GET or POST without a user agent
Source: global traffic HTTP traffic detected: GET /os16/?XL3pvD=fPwrUrgVvuqeO931Dg4gzzbtrd7thr2/NsJ/u9TrNiEyg4FeGnR3RlXi6kvbgSn2o0yC&m0Dd=nFQHcLg0mfV8fj HTTP/1.1Host: www.royalfountainlogistics.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /os16/?XL3pvD=wD4cT7q48NFnhCndHw9GtexQ1GWRT95jx29TDgoZhFSVm5lLt3bl1PAkaHfi4RiaXjL3&m0Dd=nFQHcLg0mfV8fj HTTP/1.1Host: www.bitherders.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
IP address seen in connection with other malware
Source: Joe Sandbox View IP Address: 3.64.163.50 3.64.163.50
Source: global traffic HTTP traffic detected: HTTP/1.1 403 ForbiddenServer: openrestyDate: Fri, 28 Jan 2022 09:35:12 GMTContent-Type: text/htmlContent-Length: 275ETag: "61f22041-113"Via: 1.1 googleConnection: closeData Raw: 3c 21 44 4f 43 54 59 50 45 20 68 74 6d 6c 3e 0a 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 3e 0a 3c 68 65 61 64 3e 0a 20 20 20 20 3c 6d 65 74 61 20 68 74 74 70 2d 65 71 75 69 76 3d 22 63 6f 6e 74 65 6e 74 2d 74 79 70 65 22 20 63 6f 6e 74 65 6e 74 3d 22 74 65 78 74 2f 68 74 6d 6c 3b 63 68 61 72 73 65 74 3d 75 74 66 2d 38 22 3e 0a 20 20 20 20 3c 6c 69 6e 6b 20 72 65 6c 3d 22 73 68 6f 72 74 63 75 74 20 69 63 6f 6e 22 20 68 72 65 66 3d 22 64 61 74 61 3a 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 3b 2c 22 20 74 79 70 65 3d 22 69 6d 61 67 65 2f 78 2d 69 63 6f 6e 22 3e 0a 20 20 20 20 3c 74 69 74 6c 65 3e 46 6f 72 62 69 64 64 65 6e 3c 2f 74 69 74 6c 65 3e 0a 3c 2f 68 65 61 64 3e 0a 3c 62 6f 64 79 3e 0a 3c 68 31 3e 41 63 63 65 73 73 20 46 6f 72 62 69 64 64 65 6e 3c 2f 68 31 3e 0a 3c 2f 62 6f 64 79 3e 0a 3c 2f 68 74 6d 6c 3e 0a Data Ascii: <!DOCTYPE html><html lang="en"><head> <meta http-equiv="content-type" content="text/html;charset=utf-8"> <link rel="shortcut icon" href="data:image/x-icon;," type="image/x-icon"> <title>Forbidden</title></head><body><h1>Access Forbidden</h1></body></html>
Source: new_order.exe String found in binary or memory: http://nsis.sf.net/NSIS_Error
Source: new_order.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: explorer.exe, 00000009.00000002.947761745.00000000052FF000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.bitherders.com
Source: explorer.exe, 00000009.00000002.947761745.00000000052FF000.00000004.10000000.00040000.00000000.sdmp String found in binary or memory: http://www.bitherders.com/
Source: unknown DNS traffic detected: queries for: www.royalfountainlogistics.com
Source: global traffic HTTP traffic detected: GET /os16/?XL3pvD=fPwrUrgVvuqeO931Dg4gzzbtrd7thr2/NsJ/u9TrNiEyg4FeGnR3RlXi6kvbgSn2o0yC&m0Dd=nFQHcLg0mfV8fj HTTP/1.1Host: www.royalfountainlogistics.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:
Source: global traffic HTTP traffic detected: GET /os16/?XL3pvD=wD4cT7q48NFnhCndHw9GtexQ1GWRT95jx29TDgoZhFSVm5lLt3bl1PAkaHfi4RiaXjL3&m0Dd=nFQHcLg0mfV8fj HTTP/1.1Host: www.bitherders.comConnection: closeData Raw: 00 00 00 00 00 00 00 Data Ascii:

Key, Mouse, Clipboard, Microphone and Screen Capturing
barindex
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00404F61 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,SendMessageA,ShowWindow,ShowWindow,GetDlgItem,SendMessageA,SendMessageA,SendMessageA,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageA,CreatePopupMenu,AppendMenuA,GetWindowRect,TrackPopupMenu,SendMessageA,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageA,GlobalUnlock,SetClipboardData,CloseClipboard, 1_2_00404F61

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 3.0.new_order.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.new_order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.new_order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.new_order.exe.1acb0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.new_order.exe.1acb0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946218609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946443311.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.738390030.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.754910561.00000000004C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.688696186.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.723911761.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946503989.0000000000850000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.687734511.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.754825305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.755193140.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 3.0.new_order.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.new_order.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.new_order.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.new_order.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.new_order.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.new_order.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.new_order.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.new_order.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.new_order.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.new_order.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.2.new_order.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.2.new_order.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 3.0.new_order.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 3.0.new_order.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.new_order.exe.1acb0000.2.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.new_order.exe.1acb0000.2.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.new_order.exe.1acb0000.2.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.new_order.exe.1acb0000.2.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.946218609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.946218609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.946443311.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.946443311.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.738390030.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.738390030.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.754910561.00000000004C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.754910561.00000000004C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.688696186.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.688696186.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000005.00000000.723911761.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000005.00000000.723911761.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000009.00000002.946503989.0000000000850000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000009.00000002.946503989.0000000000850000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.687734511.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.687734511.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.754825305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.754825305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000002.755193140.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000002.755193140.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Initial sample is a PE file and has a suspicious name
Source: initial sample Static PE information: Filename: new_order.exe
Uses 32bit PE files
Source: new_order.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 3.0.new_order.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.new_order.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.new_order.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.new_order.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.new_order.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.new_order.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.new_order.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.new_order.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.new_order.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.new_order.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.2.new_order.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.2.new_order.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 3.0.new_order.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 3.0.new_order.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.new_order.exe.1acb0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.new_order.exe.1acb0000.2.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.new_order.exe.1acb0000.2.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.new_order.exe.1acb0000.2.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.946218609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.946218609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.946443311.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.946443311.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.738390030.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.738390030.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.754910561.00000000004C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.754910561.00000000004C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.688696186.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.688696186.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000005.00000000.723911761.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000005.00000000.723911761.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000009.00000002.946503989.0000000000850000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000009.00000002.946503989.0000000000850000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.687734511.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.687734511.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.754825305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.754825305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000002.755193140.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000002.755193140.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00403225 EntryPoint,#17,SetErrorMode,OleInitialize,SHGetFileInfoA,GetCommandLineA,GetModuleHandleA,CharNextA,GetTempPathA,GetWindowsDirectoryA,lstrcatA,DeleteFileA,OleUninitialize,ExitProcess,lstrcatA,lstrcmpiA,CreateDirectoryA,SetCurrentDirectoryA,DeleteFileA,CopyFileA,CloseHandle,GetCurrentProcess,ExitWindowsEx,ExitProcess, 1_2_00403225
Detected potential crypto function
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_0040604C 1_2_0040604C
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00404772 1_2_00404772
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_02180A17 1_2_02180A17
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00401030 3_2_00401030
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041DB0E 3_2_0041DB0E
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041EB8D 3_2_0041EB8D
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041E5DC 3_2_0041E5DC
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00402D90 3_2_00402D90
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041D596 3_2_0041D596
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00409E4B 3_2_00409E4B
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00409E50 3_2_00409E50
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041EFC2 3_2_0041EFC2
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00402FB0 3_2_00402FB0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A820A0 3_2_00A820A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00B220A8 3_2_00B220A8
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A6B090 3_2_00A6B090
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00B11002 3_2_00B11002
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A74120 3_2_00A74120
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A5F900 3_2_00A5F900
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00B222AE 3_2_00B222AE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491B090 9_2_0491B090
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491841F 9_2_0491841F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1002 9_2_049C1002
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932581 9_2_04932581
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491D5E0 9_2_0491D5E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490F900 9_2_0490F900
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04900D20 9_2_04900D20
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04924120 9_2_04924120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D1D55 9_2_049D1D55
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04926E30 9_2_04926E30
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493EBB0 9_2_0493EBB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041DB0E 9_2_0041DB0E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041EB8D 9_2_0041EB8D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041E5DC 9_2_0041E5DC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_00402D90 9_2_00402D90
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041D596 9_2_0041D596
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_00409E4B 9_2_00409E4B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_00409E50 9_2_00409E50
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041EFC2 9_2_0041EFC2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_00402FB0 9_2_00402FB0
Found potential string decryption / allocating functions
Source: C:\Windows\SysWOW64\explorer.exe Code function: String function: 0490B150 appears 32 times
Contains functionality to call native functions
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041A350 NtCreateFile, 3_2_0041A350
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041A400 NtReadFile, 3_2_0041A400
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041A480 NtClose, 3_2_0041A480
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041A530 NtAllocateVirtualMemory, 3_2_0041A530
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041A3A2 NtCreateFile, 3_2_0041A3A2
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041A47A NtClose, 3_2_0041A47A
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041A52A NtAllocateVirtualMemory, 3_2_0041A52A
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A998F0 NtReadVirtualMemory,LdrInitializeThunk, 3_2_00A998F0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99860 NtQuerySystemInformation,LdrInitializeThunk, 3_2_00A99860
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99840 NtDelayExecution,LdrInitializeThunk, 3_2_00A99840
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A999A0 NtCreateSection,LdrInitializeThunk, 3_2_00A999A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99910 NtAdjustPrivilegesToken,LdrInitializeThunk, 3_2_00A99910
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99A20 NtResumeThread,LdrInitializeThunk, 3_2_00A99A20
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99A00 NtProtectVirtualMemory,LdrInitializeThunk, 3_2_00A99A00
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99A50 NtCreateFile,LdrInitializeThunk, 3_2_00A99A50
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A995D0 NtClose,LdrInitializeThunk, 3_2_00A995D0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99540 NtReadFile,LdrInitializeThunk, 3_2_00A99540
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A996E0 NtFreeVirtualMemory,LdrInitializeThunk, 3_2_00A996E0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99660 NtAllocateVirtualMemory,LdrInitializeThunk, 3_2_00A99660
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A997A0 NtUnmapViewOfSection,LdrInitializeThunk, 3_2_00A997A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99780 NtMapViewOfSection,LdrInitializeThunk, 3_2_00A99780
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99710 NtQueryInformationToken,LdrInitializeThunk, 3_2_00A99710
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A998A0 NtWriteVirtualMemory, 3_2_00A998A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99820 NtEnumerateKey, 3_2_00A99820
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A9B040 NtSuspendThread, 3_2_00A9B040
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A999D0 NtCreateProcessEx, 3_2_00A999D0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99950 NtQueueApcThread, 3_2_00A99950
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A99A80 NtOpenDirectoryObject, 3_2_00A99A80
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949840 NtDelayExecution,LdrInitializeThunk, 9_2_04949840
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949860 NtQuerySystemInformation,LdrInitializeThunk, 9_2_04949860
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049499A0 NtCreateSection,LdrInitializeThunk, 9_2_049499A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049495D0 NtClose,LdrInitializeThunk, 9_2_049495D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949910 NtAdjustPrivilegesToken,LdrInitializeThunk, 9_2_04949910
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949540 NtReadFile,LdrInitializeThunk, 9_2_04949540
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049496D0 NtCreateKey,LdrInitializeThunk, 9_2_049496D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049496E0 NtFreeVirtualMemory,LdrInitializeThunk, 9_2_049496E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949650 NtQueryValueKey,LdrInitializeThunk, 9_2_04949650
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949A50 NtCreateFile,LdrInitializeThunk, 9_2_04949A50
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949660 NtAllocateVirtualMemory,LdrInitializeThunk, 9_2_04949660
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949780 NtMapViewOfSection,LdrInitializeThunk, 9_2_04949780
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949FE0 NtCreateMutant,LdrInitializeThunk, 9_2_04949FE0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949710 NtQueryInformationToken,LdrInitializeThunk, 9_2_04949710
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049498A0 NtWriteVirtualMemory, 9_2_049498A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049498F0 NtReadVirtualMemory, 9_2_049498F0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949820 NtEnumerateKey, 9_2_04949820
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0494B040 NtSuspendThread, 9_2_0494B040
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049499D0 NtCreateProcessEx, 9_2_049499D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049495F0 NtQueryInformationFile, 9_2_049495F0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0494AD30 NtSetContextThread, 9_2_0494AD30
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949520 NtWaitForSingleObject, 9_2_04949520
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949950 NtQueueApcThread, 9_2_04949950
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949560 NtWriteFile, 9_2_04949560
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949A80 NtOpenDirectoryObject, 9_2_04949A80
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949610 NtEnumerateValueKey, 9_2_04949610
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949A10 NtQuerySection, 9_2_04949A10
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949A00 NtProtectVirtualMemory, 9_2_04949A00
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949A20 NtResumeThread, 9_2_04949A20
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949670 NtQueryInformationProcess, 9_2_04949670
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0494A3B0 NtGetContextThread, 9_2_0494A3B0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049497A0 NtUnmapViewOfSection, 9_2_049497A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0494A710 NtOpenProcessToken, 9_2_0494A710
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949B00 NtSetValueKey, 9_2_04949B00
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949730 NtQueryVirtualMemory, 9_2_04949730
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949770 NtSetInformationFile, 9_2_04949770
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0494A770 NtOpenThread, 9_2_0494A770
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04949760 NtOpenProcess, 9_2_04949760
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041A350 NtCreateFile, 9_2_0041A350
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041A400 NtReadFile, 9_2_0041A400
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041A480 NtClose, 9_2_0041A480
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041A530 NtAllocateVirtualMemory, 9_2_0041A530
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041A3A2 NtCreateFile, 9_2_0041A3A2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041A47A NtClose, 9_2_0041A47A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041A52A NtAllocateVirtualMemory, 9_2_0041A52A
Sample file is different than original file name gathered from version info
Source: new_order.exe, 00000001.00000003.688386050.000000001AF9F000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs new_order.exe
Source: new_order.exe, 00000001.00000003.685072751.000000001AE06000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs new_order.exe
Source: new_order.exe, 00000003.00000002.756160019.0000000000CDF000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs new_order.exe
Source: new_order.exe, 00000003.00000002.757240625.00000000029AE000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: OriginalFilenameEXPLORER.EXEj% vs new_order.exe
Source: new_order.exe, 00000003.00000002.755889616.0000000000B4F000.00000040.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs new_order.exe
Source: new_order.exe, 00000003.00000003.690131310.0000000000806000.00000004.00000800.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs new_order.exe
Source: C:\Users\user\Desktop\new_order.exe File read: C:\Users\user\Desktop\new_order.exe Jump to behavior
Source: new_order.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\new_order.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\new_order.exe "C:\Users\user\Desktop\new_order.exe"
Source: C:\Users\user\Desktop\new_order.exe Process created: C:\Users\user\Desktop\new_order.exe "C:\Users\user\Desktop\new_order.exe"
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\new_order.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\new_order.exe Process created: C:\Users\user\Desktop\new_order.exe "C:\Users\user\Desktop\new_order.exe" Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\new_order.exe" Jump to behavior
Source: C:\Users\user\Desktop\new_order.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\new_order.exe File created: C:\Users\user\AppData\Local\Temp\nsv94CB.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@7/4@3/2
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00402012 CoCreateInstance,MultiByteToWideChar, 1_2_00402012
Source: C:\Users\user\Desktop\new_order.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00404275 GetDlgItem,SetWindowTextA,SHBrowseForFolderA,CoTaskMemFree,lstrcmpiA,lstrcatA,SetDlgItemTextA,GetDiskFreeSpaceA,MulDiv,SetDlgItemTextA, 1_2_00404275
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:7040:120:WilError_01
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\explorer.exe
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Binary string: explorer.pdbUGP source: new_order.exe, 00000003.00000002.756328616.0000000002660000.00000040.10000000.00040000.00000000.sdmp
Source: Binary string: wntdll.pdbUGP source: new_order.exe, 00000001.00000003.684420646.000000001AE80000.00000004.00000800.00020000.00000000.sdmp, new_order.exe, 00000001.00000003.688778251.000000001ACF0000.00000004.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000003.689848535.00000000006F0000.00000004.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000002.755436113.0000000000A30000.00000040.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000002.755889616.0000000000B4F000.00000040.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.947351653.00000000049FF000.00000040.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.947213320.00000000048E0000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: new_order.exe, new_order.exe, 00000003.00000003.689848535.00000000006F0000.00000004.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000002.755436113.0000000000A30000.00000040.00000800.00020000.00000000.sdmp, new_order.exe, 00000003.00000002.755889616.0000000000B4F000.00000040.00000800.00020000.00000000.sdmp, explorer.exe, explorer.exe, 00000009.00000002.947351653.00000000049FF000.00000040.00000800.00020000.00000000.sdmp, explorer.exe, 00000009.00000002.947213320.00000000048E0000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: explorer.pdb source: new_order.exe, 00000003.00000002.756328616.0000000002660000.00000040.10000000.00040000.00000000.sdmp

Data Obfuscation
barindex
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041E9E6 push 23797168h; ret 3_2_0041EA07
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0040E341 push ebp; retf 3_2_0040E342
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00409BCD push ebx; ret 3_2_00409BCE
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00419C33 push cs; retf 3_2_00419C3F
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041D4F2 push eax; ret 3_2_0041D4F8
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041D4FB push eax; ret 3_2_0041D562
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041D4A5 push eax; ret 3_2_0041D4F8
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0041D55C push eax; ret 3_2_0041D562
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_004085C2 push edi; retn 6E42h 3_2_004085C6
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00419FF2 push edi; iretd 3_2_00419FFA
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AAD0D1 push ecx; ret 3_2_00AAD0E4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0495D0D1 push ecx; ret 9_2_0495D0E4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041E9E6 push 23797168h; ret 9_2_0041EA07
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0040E341 push ebp; retf 9_2_0040E342
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_00409BCD push ebx; ret 9_2_00409BCE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_00419C33 push cs; retf 9_2_00419C3F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041D4F2 push eax; ret 9_2_0041D4F8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041D4FB push eax; ret 9_2_0041D562
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041D4A5 push eax; ret 9_2_0041D4F8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0041D55C push eax; ret 9_2_0041D562
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_00419FF2 push edi; iretd 9_2_00419FFA
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress, 1_2_00405DA3

Persistence and Installation Behavior
barindex
Drops PE files
Source: C:\Users\user\Desktop\new_order.exe File created: C:\Users\user\AppData\Local\Temp\nsq94FC.tmp\yvucmw.dll Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x81 0x1E 0xE0
Self deletion via cmd delete
Source: C:\Windows\SysWOW64\explorer.exe Process created: /c del "C:\Users\user\Desktop\new_order.exe"
Source: C:\Windows\SysWOW64\explorer.exe Process created: /c del "C:\Users\user\Desktop\new_order.exe" Jump to behavior
Source: C:\Users\user\Desktop\new_order.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe Process information set: NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors)
Source: C:\Users\user\Desktop\new_order.exe Evasive API call chain: GetPEB, DecisionNodes, ExitProcess
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\Desktop\new_order.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\Desktop\new_order.exe RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\explorer.exe RDTSC instruction interceptor: First address: 0000000000409B6E second address: 0000000000409B74 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\explorer.exe TID: 6268 Thread sleep time: -42000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe TID: 6452 Thread sleep time: -36000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\explorer.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Source: C:\Users\user\Desktop\new_order.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00405D7C FindFirstFileA,FindClose, 1_2_00405D7C
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_004053AA CloseHandle,DeleteFileA,lstrcatA,lstrcatA,lstrlenA,FindFirstFileA,DeleteFileA,FindNextFileA,FindClose,RemoveDirectoryA, 1_2_004053AA
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00402630 FindFirstFileA, 1_2_00402630
Source: C:\Users\user\Desktop\new_order.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\new_order.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000005.00000000.736579180.000000000A83C000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 00000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA
Source: explorer.exe, 00000005.00000000.721102836.000000000A897000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000025700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#000000001F400000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000026700000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\STORAGE#Volume#{e6e9dfc6-98f2-11e9-90ce-806e6f6e6963}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_Msft&Prod_Virtual_DVD-ROM#2&1f4adffe&0&000001#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.736036240.000000000A60E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.736087162.000000000A64D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_SATA
Source: explorer.exe, 00000005.00000000.717209975.0000000006650000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.736036240.000000000A60E000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000005.00000000.736203145.000000000A716000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: War&Prod_VMware_SATAa
Source: explorer.exe, 00000005.00000000.729403945.0000000004710000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000[Wm
Source: explorer.exe, 00000005.00000000.736203145.000000000A716000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000/
Source: explorer.exe, 00000005.00000000.736087162.000000000A64D000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: 63}#0000000000100000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&t
Source: explorer.exe, 00000005.00000000.712962189.0000000004791000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\?\SCSI
Source: explorer.exe, 00000005.00000000.701800617.000000000A784000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000@

Anti Debugging
barindex
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00405DA3 GetModuleHandleA,LoadLibraryA,GetProcAddress, 1_2_00405DA3
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00409AA0 rdtsc 3_2_00409AA0
Enables debug privileges
Source: C:\Users\user\Desktop\new_order.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_02180402 mov eax, dword ptr fs:[00000030h] 1_2_02180402
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_02180616 mov eax, dword ptr fs:[00000030h] 1_2_02180616
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_02180706 mov eax, dword ptr fs:[00000030h] 1_2_02180706
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_02180744 mov eax, dword ptr fs:[00000030h] 1_2_02180744
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_021806C7 mov eax, dword ptr fs:[00000030h] 1_2_021806C7
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A990AF mov eax, dword ptr fs:[00000030h] 3_2_00A990AF
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A820A0 mov eax, dword ptr fs:[00000030h] 3_2_00A820A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A820A0 mov eax, dword ptr fs:[00000030h] 3_2_00A820A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A820A0 mov eax, dword ptr fs:[00000030h] 3_2_00A820A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A820A0 mov eax, dword ptr fs:[00000030h] 3_2_00A820A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A820A0 mov eax, dword ptr fs:[00000030h] 3_2_00A820A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A820A0 mov eax, dword ptr fs:[00000030h] 3_2_00A820A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8F0BF mov ecx, dword ptr fs:[00000030h] 3_2_00A8F0BF
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8F0BF mov eax, dword ptr fs:[00000030h] 3_2_00A8F0BF
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8F0BF mov eax, dword ptr fs:[00000030h] 3_2_00A8F0BF
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A59080 mov eax, dword ptr fs:[00000030h] 3_2_00A59080
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD3884 mov eax, dword ptr fs:[00000030h] 3_2_00AD3884
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD3884 mov eax, dword ptr fs:[00000030h] 3_2_00AD3884
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A558EC mov eax, dword ptr fs:[00000030h] 3_2_00A558EC
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00AEB8D0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AEB8D0 mov ecx, dword ptr fs:[00000030h] 3_2_00AEB8D0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00AEB8D0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00AEB8D0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00AEB8D0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AEB8D0 mov eax, dword ptr fs:[00000030h] 3_2_00AEB8D0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8002D mov eax, dword ptr fs:[00000030h] 3_2_00A8002D
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8002D mov eax, dword ptr fs:[00000030h] 3_2_00A8002D
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8002D mov eax, dword ptr fs:[00000030h] 3_2_00A8002D
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8002D mov eax, dword ptr fs:[00000030h] 3_2_00A8002D
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8002D mov eax, dword ptr fs:[00000030h] 3_2_00A8002D
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A6B02A mov eax, dword ptr fs:[00000030h] 3_2_00A6B02A
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A6B02A mov eax, dword ptr fs:[00000030h] 3_2_00A6B02A
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A6B02A mov eax, dword ptr fs:[00000030h] 3_2_00A6B02A
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A6B02A mov eax, dword ptr fs:[00000030h] 3_2_00A6B02A
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00B24015 mov eax, dword ptr fs:[00000030h] 3_2_00B24015
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00B24015 mov eax, dword ptr fs:[00000030h] 3_2_00B24015
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD7016 mov eax, dword ptr fs:[00000030h] 3_2_00AD7016
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD7016 mov eax, dword ptr fs:[00000030h] 3_2_00AD7016
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD7016 mov eax, dword ptr fs:[00000030h] 3_2_00AD7016
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00B12073 mov eax, dword ptr fs:[00000030h] 3_2_00B12073
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00B21074 mov eax, dword ptr fs:[00000030h] 3_2_00B21074
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A70050 mov eax, dword ptr fs:[00000030h] 3_2_00A70050
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A70050 mov eax, dword ptr fs:[00000030h] 3_2_00A70050
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A861A0 mov eax, dword ptr fs:[00000030h] 3_2_00A861A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A861A0 mov eax, dword ptr fs:[00000030h] 3_2_00A861A0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD69A6 mov eax, dword ptr fs:[00000030h] 3_2_00AD69A6
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD51BE mov eax, dword ptr fs:[00000030h] 3_2_00AD51BE
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD51BE mov eax, dword ptr fs:[00000030h] 3_2_00AD51BE
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD51BE mov eax, dword ptr fs:[00000030h] 3_2_00AD51BE
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AD51BE mov eax, dword ptr fs:[00000030h] 3_2_00AD51BE
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A7C182 mov eax, dword ptr fs:[00000030h] 3_2_00A7C182
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8A185 mov eax, dword ptr fs:[00000030h] 3_2_00A8A185
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A82990 mov eax, dword ptr fs:[00000030h] 3_2_00A82990
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A5B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00A5B1E1
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A5B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00A5B1E1
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A5B1E1 mov eax, dword ptr fs:[00000030h] 3_2_00A5B1E1
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00AE41E8 mov eax, dword ptr fs:[00000030h] 3_2_00AE41E8
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A74120 mov eax, dword ptr fs:[00000030h] 3_2_00A74120
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A74120 mov eax, dword ptr fs:[00000030h] 3_2_00A74120
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A74120 mov eax, dword ptr fs:[00000030h] 3_2_00A74120
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A74120 mov eax, dword ptr fs:[00000030h] 3_2_00A74120
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A74120 mov ecx, dword ptr fs:[00000030h] 3_2_00A74120
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8513A mov eax, dword ptr fs:[00000030h] 3_2_00A8513A
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8513A mov eax, dword ptr fs:[00000030h] 3_2_00A8513A
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A59100 mov eax, dword ptr fs:[00000030h] 3_2_00A59100
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A59100 mov eax, dword ptr fs:[00000030h] 3_2_00A59100
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A59100 mov eax, dword ptr fs:[00000030h] 3_2_00A59100
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A5C962 mov eax, dword ptr fs:[00000030h] 3_2_00A5C962
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A5B171 mov eax, dword ptr fs:[00000030h] 3_2_00A5B171
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A5B171 mov eax, dword ptr fs:[00000030h] 3_2_00A5B171
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A7B944 mov eax, dword ptr fs:[00000030h] 3_2_00A7B944
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A7B944 mov eax, dword ptr fs:[00000030h] 3_2_00A7B944
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A552A5 mov eax, dword ptr fs:[00000030h] 3_2_00A552A5
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A552A5 mov eax, dword ptr fs:[00000030h] 3_2_00A552A5
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A552A5 mov eax, dword ptr fs:[00000030h] 3_2_00A552A5
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A552A5 mov eax, dword ptr fs:[00000030h] 3_2_00A552A5
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A552A5 mov eax, dword ptr fs:[00000030h] 3_2_00A552A5
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A6AAB0 mov eax, dword ptr fs:[00000030h] 3_2_00A6AAB0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A6AAB0 mov eax, dword ptr fs:[00000030h] 3_2_00A6AAB0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8FAB0 mov eax, dword ptr fs:[00000030h] 3_2_00A8FAB0
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8D294 mov eax, dword ptr fs:[00000030h] 3_2_00A8D294
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A8D294 mov eax, dword ptr fs:[00000030h] 3_2_00A8D294
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_00A82AE4 mov eax, dword ptr fs:[00000030h] 3_2_00A82AE4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491849B mov eax, dword ptr fs:[00000030h] 9_2_0491849B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04909080 mov eax, dword ptr fs:[00000030h] 9_2_04909080
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04983884 mov eax, dword ptr fs:[00000030h] 9_2_04983884
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04983884 mov eax, dword ptr fs:[00000030h] 9_2_04983884
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493F0BF mov ecx, dword ptr fs:[00000030h] 9_2_0493F0BF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493F0BF mov eax, dword ptr fs:[00000030h] 9_2_0493F0BF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493F0BF mov eax, dword ptr fs:[00000030h] 9_2_0493F0BF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049490AF mov eax, dword ptr fs:[00000030h] 9_2_049490AF
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0499B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499B8D0 mov ecx, dword ptr fs:[00000030h] 9_2_0499B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0499B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0499B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0499B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499B8D0 mov eax, dword ptr fs:[00000030h] 9_2_0499B8D0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D8CD6 mov eax, dword ptr fs:[00000030h] 9_2_049D8CD6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C14FB mov eax, dword ptr fs:[00000030h] 9_2_049C14FB
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04986CF0 mov eax, dword ptr fs:[00000030h] 9_2_04986CF0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04986CF0 mov eax, dword ptr fs:[00000030h] 9_2_04986CF0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04986CF0 mov eax, dword ptr fs:[00000030h] 9_2_04986CF0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D4015 mov eax, dword ptr fs:[00000030h] 9_2_049D4015
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D4015 mov eax, dword ptr fs:[00000030h] 9_2_049D4015
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04987016 mov eax, dword ptr fs:[00000030h] 9_2_04987016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04987016 mov eax, dword ptr fs:[00000030h] 9_2_04987016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04987016 mov eax, dword ptr fs:[00000030h] 9_2_04987016
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D740D mov eax, dword ptr fs:[00000030h] 9_2_049D740D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D740D mov eax, dword ptr fs:[00000030h] 9_2_049D740D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D740D mov eax, dword ptr fs:[00000030h] 9_2_049D740D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04986C0A mov eax, dword ptr fs:[00000030h] 9_2_04986C0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04986C0A mov eax, dword ptr fs:[00000030h] 9_2_04986C0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04986C0A mov eax, dword ptr fs:[00000030h] 9_2_04986C0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04986C0A mov eax, dword ptr fs:[00000030h] 9_2_04986C0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C1C06 mov eax, dword ptr fs:[00000030h] 9_2_049C1C06
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491B02A mov eax, dword ptr fs:[00000030h] 9_2_0491B02A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491B02A mov eax, dword ptr fs:[00000030h] 9_2_0491B02A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491B02A mov eax, dword ptr fs:[00000030h] 9_2_0491B02A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491B02A mov eax, dword ptr fs:[00000030h] 9_2_0491B02A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493002D mov eax, dword ptr fs:[00000030h] 9_2_0493002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493002D mov eax, dword ptr fs:[00000030h] 9_2_0493002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493002D mov eax, dword ptr fs:[00000030h] 9_2_0493002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493002D mov eax, dword ptr fs:[00000030h] 9_2_0493002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493002D mov eax, dword ptr fs:[00000030h] 9_2_0493002D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493BC2C mov eax, dword ptr fs:[00000030h] 9_2_0493BC2C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04920050 mov eax, dword ptr fs:[00000030h] 9_2_04920050
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04920050 mov eax, dword ptr fs:[00000030h] 9_2_04920050
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499C450 mov eax, dword ptr fs:[00000030h] 9_2_0499C450
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499C450 mov eax, dword ptr fs:[00000030h] 9_2_0499C450
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493A44B mov eax, dword ptr fs:[00000030h] 9_2_0493A44B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D1074 mov eax, dword ptr fs:[00000030h] 9_2_049D1074
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C2073 mov eax, dword ptr fs:[00000030h] 9_2_049C2073
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492746D mov eax, dword ptr fs:[00000030h] 9_2_0492746D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932990 mov eax, dword ptr fs:[00000030h] 9_2_04932990
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493FD9B mov eax, dword ptr fs:[00000030h] 9_2_0493FD9B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493FD9B mov eax, dword ptr fs:[00000030h] 9_2_0493FD9B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492C182 mov eax, dword ptr fs:[00000030h] 9_2_0492C182
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932581 mov eax, dword ptr fs:[00000030h] 9_2_04932581
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932581 mov eax, dword ptr fs:[00000030h] 9_2_04932581
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932581 mov eax, dword ptr fs:[00000030h] 9_2_04932581
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932581 mov eax, dword ptr fs:[00000030h] 9_2_04932581
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493A185 mov eax, dword ptr fs:[00000030h] 9_2_0493A185
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04902D8A mov eax, dword ptr fs:[00000030h] 9_2_04902D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04902D8A mov eax, dword ptr fs:[00000030h] 9_2_04902D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04902D8A mov eax, dword ptr fs:[00000030h] 9_2_04902D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04902D8A mov eax, dword ptr fs:[00000030h] 9_2_04902D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04902D8A mov eax, dword ptr fs:[00000030h] 9_2_04902D8A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04931DB5 mov eax, dword ptr fs:[00000030h] 9_2_04931DB5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04931DB5 mov eax, dword ptr fs:[00000030h] 9_2_04931DB5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04931DB5 mov eax, dword ptr fs:[00000030h] 9_2_04931DB5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049851BE mov eax, dword ptr fs:[00000030h] 9_2_049851BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049851BE mov eax, dword ptr fs:[00000030h] 9_2_049851BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049851BE mov eax, dword ptr fs:[00000030h] 9_2_049851BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049851BE mov eax, dword ptr fs:[00000030h] 9_2_049851BE
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049335A1 mov eax, dword ptr fs:[00000030h] 9_2_049335A1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049361A0 mov eax, dword ptr fs:[00000030h] 9_2_049361A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049361A0 mov eax, dword ptr fs:[00000030h] 9_2_049361A0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049869A6 mov eax, dword ptr fs:[00000030h] 9_2_049869A6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049B8DF1 mov eax, dword ptr fs:[00000030h] 9_2_049B8DF1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0490B1E1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0490B1E1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490B1E1 mov eax, dword ptr fs:[00000030h] 9_2_0490B1E1
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049941E8 mov eax, dword ptr fs:[00000030h] 9_2_049941E8
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491D5E0 mov eax, dword ptr fs:[00000030h] 9_2_0491D5E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491D5E0 mov eax, dword ptr fs:[00000030h] 9_2_0491D5E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04909100 mov eax, dword ptr fs:[00000030h] 9_2_04909100
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04909100 mov eax, dword ptr fs:[00000030h] 9_2_04909100
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04909100 mov eax, dword ptr fs:[00000030h] 9_2_04909100
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490AD30 mov eax, dword ptr fs:[00000030h] 9_2_0490AD30
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04913D34 mov eax, dword ptr fs:[00000030h] 9_2_04913D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04934D3B mov eax, dword ptr fs:[00000030h] 9_2_04934D3B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04934D3B mov eax, dword ptr fs:[00000030h] 9_2_04934D3B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04934D3B mov eax, dword ptr fs:[00000030h] 9_2_04934D3B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D8D34 mov eax, dword ptr fs:[00000030h] 9_2_049D8D34
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493513A mov eax, dword ptr fs:[00000030h] 9_2_0493513A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493513A mov eax, dword ptr fs:[00000030h] 9_2_0493513A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0498A537 mov eax, dword ptr fs:[00000030h] 9_2_0498A537
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04924120 mov eax, dword ptr fs:[00000030h] 9_2_04924120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04924120 mov eax, dword ptr fs:[00000030h] 9_2_04924120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04924120 mov eax, dword ptr fs:[00000030h] 9_2_04924120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04924120 mov eax, dword ptr fs:[00000030h] 9_2_04924120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04924120 mov ecx, dword ptr fs:[00000030h] 9_2_04924120
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04927D50 mov eax, dword ptr fs:[00000030h] 9_2_04927D50
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492B944 mov eax, dword ptr fs:[00000030h] 9_2_0492B944
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492B944 mov eax, dword ptr fs:[00000030h] 9_2_0492B944
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04943D43 mov eax, dword ptr fs:[00000030h] 9_2_04943D43
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04983540 mov eax, dword ptr fs:[00000030h] 9_2_04983540
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490B171 mov eax, dword ptr fs:[00000030h] 9_2_0490B171
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490B171 mov eax, dword ptr fs:[00000030h] 9_2_0490B171
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492C577 mov eax, dword ptr fs:[00000030h] 9_2_0492C577
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492C577 mov eax, dword ptr fs:[00000030h] 9_2_0492C577
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490C962 mov eax, dword ptr fs:[00000030h] 9_2_0490C962
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493D294 mov eax, dword ptr fs:[00000030h] 9_2_0493D294
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493D294 mov eax, dword ptr fs:[00000030h] 9_2_0493D294
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499FE87 mov eax, dword ptr fs:[00000030h] 9_2_0499FE87
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491AAB0 mov eax, dword ptr fs:[00000030h] 9_2_0491AAB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491AAB0 mov eax, dword ptr fs:[00000030h] 9_2_0491AAB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493FAB0 mov eax, dword ptr fs:[00000030h] 9_2_0493FAB0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049052A5 mov eax, dword ptr fs:[00000030h] 9_2_049052A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049052A5 mov eax, dword ptr fs:[00000030h] 9_2_049052A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049052A5 mov eax, dword ptr fs:[00000030h] 9_2_049052A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049052A5 mov eax, dword ptr fs:[00000030h] 9_2_049052A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049052A5 mov eax, dword ptr fs:[00000030h] 9_2_049052A5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D0EA5 mov eax, dword ptr fs:[00000030h] 9_2_049D0EA5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D0EA5 mov eax, dword ptr fs:[00000030h] 9_2_049D0EA5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D0EA5 mov eax, dword ptr fs:[00000030h] 9_2_049D0EA5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049846A7 mov eax, dword ptr fs:[00000030h] 9_2_049846A7
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D8ED6 mov eax, dword ptr fs:[00000030h] 9_2_049D8ED6
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04948EC7 mov eax, dword ptr fs:[00000030h] 9_2_04948EC7
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932ACB mov eax, dword ptr fs:[00000030h] 9_2_04932ACB
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049BFEC0 mov eax, dword ptr fs:[00000030h] 9_2_049BFEC0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049336CC mov eax, dword ptr fs:[00000030h] 9_2_049336CC
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049316E0 mov ecx, dword ptr fs:[00000030h] 9_2_049316E0
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049176E2 mov eax, dword ptr fs:[00000030h] 9_2_049176E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932AE4 mov eax, dword ptr fs:[00000030h] 9_2_04932AE4
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490AA16 mov eax, dword ptr fs:[00000030h] 9_2_0490AA16
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490AA16 mov eax, dword ptr fs:[00000030h] 9_2_0490AA16
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04923A1C mov eax, dword ptr fs:[00000030h] 9_2_04923A1C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493A61C mov eax, dword ptr fs:[00000030h] 9_2_0493A61C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493A61C mov eax, dword ptr fs:[00000030h] 9_2_0493A61C
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490C600 mov eax, dword ptr fs:[00000030h] 9_2_0490C600
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490C600 mov eax, dword ptr fs:[00000030h] 9_2_0490C600
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490C600 mov eax, dword ptr fs:[00000030h] 9_2_0490C600
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04938E00 mov eax, dword ptr fs:[00000030h] 9_2_04938E00
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04918A0A mov eax, dword ptr fs:[00000030h] 9_2_04918A0A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049BFE3F mov eax, dword ptr fs:[00000030h] 9_2_049BFE3F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490E620 mov eax, dword ptr fs:[00000030h] 9_2_0490E620
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04994257 mov eax, dword ptr fs:[00000030h] 9_2_04994257
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04909240 mov eax, dword ptr fs:[00000030h] 9_2_04909240
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04909240 mov eax, dword ptr fs:[00000030h] 9_2_04909240
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04909240 mov eax, dword ptr fs:[00000030h] 9_2_04909240
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04909240 mov eax, dword ptr fs:[00000030h] 9_2_04909240
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04917E41 mov eax, dword ptr fs:[00000030h] 9_2_04917E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04917E41 mov eax, dword ptr fs:[00000030h] 9_2_04917E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04917E41 mov eax, dword ptr fs:[00000030h] 9_2_04917E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04917E41 mov eax, dword ptr fs:[00000030h] 9_2_04917E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04917E41 mov eax, dword ptr fs:[00000030h] 9_2_04917E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04917E41 mov eax, dword ptr fs:[00000030h] 9_2_04917E41
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492AE73 mov eax, dword ptr fs:[00000030h] 9_2_0492AE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492AE73 mov eax, dword ptr fs:[00000030h] 9_2_0492AE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492AE73 mov eax, dword ptr fs:[00000030h] 9_2_0492AE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492AE73 mov eax, dword ptr fs:[00000030h] 9_2_0492AE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492AE73 mov eax, dword ptr fs:[00000030h] 9_2_0492AE73
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0494927A mov eax, dword ptr fs:[00000030h] 9_2_0494927A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049BB260 mov eax, dword ptr fs:[00000030h] 9_2_049BB260
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049BB260 mov eax, dword ptr fs:[00000030h] 9_2_049BB260
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491766D mov eax, dword ptr fs:[00000030h] 9_2_0491766D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D8A62 mov eax, dword ptr fs:[00000030h] 9_2_049D8A62
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493B390 mov eax, dword ptr fs:[00000030h] 9_2_0493B390
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04932397 mov eax, dword ptr fs:[00000030h] 9_2_04932397
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04918794 mov eax, dword ptr fs:[00000030h] 9_2_04918794
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04987794 mov eax, dword ptr fs:[00000030h] 9_2_04987794
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04987794 mov eax, dword ptr fs:[00000030h] 9_2_04987794
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04987794 mov eax, dword ptr fs:[00000030h] 9_2_04987794
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C138A mov eax, dword ptr fs:[00000030h] 9_2_049C138A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049BD380 mov ecx, dword ptr fs:[00000030h] 9_2_049BD380
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04911B8F mov eax, dword ptr fs:[00000030h] 9_2_04911B8F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04911B8F mov eax, dword ptr fs:[00000030h] 9_2_04911B8F
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D5BA5 mov eax, dword ptr fs:[00000030h] 9_2_049D5BA5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04934BAD mov eax, dword ptr fs:[00000030h] 9_2_04934BAD
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04934BAD mov eax, dword ptr fs:[00000030h] 9_2_04934BAD
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04934BAD mov eax, dword ptr fs:[00000030h] 9_2_04934BAD
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049853CA mov eax, dword ptr fs:[00000030h] 9_2_049853CA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049853CA mov eax, dword ptr fs:[00000030h] 9_2_049853CA
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049437F5 mov eax, dword ptr fs:[00000030h] 9_2_049437F5
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049303E2 mov eax, dword ptr fs:[00000030h] 9_2_049303E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049303E2 mov eax, dword ptr fs:[00000030h] 9_2_049303E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049303E2 mov eax, dword ptr fs:[00000030h] 9_2_049303E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049303E2 mov eax, dword ptr fs:[00000030h] 9_2_049303E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049303E2 mov eax, dword ptr fs:[00000030h] 9_2_049303E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049303E2 mov eax, dword ptr fs:[00000030h] 9_2_049303E2
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0492F716 mov eax, dword ptr fs:[00000030h] 9_2_0492F716
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049C131B mov eax, dword ptr fs:[00000030h] 9_2_049C131B
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499FF10 mov eax, dword ptr fs:[00000030h] 9_2_0499FF10
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0499FF10 mov eax, dword ptr fs:[00000030h] 9_2_0499FF10
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D070D mov eax, dword ptr fs:[00000030h] 9_2_049D070D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D070D mov eax, dword ptr fs:[00000030h] 9_2_049D070D
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493A70E mov eax, dword ptr fs:[00000030h] 9_2_0493A70E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493A70E mov eax, dword ptr fs:[00000030h] 9_2_0493A70E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0493E730 mov eax, dword ptr fs:[00000030h] 9_2_0493E730
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04904F2E mov eax, dword ptr fs:[00000030h] 9_2_04904F2E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04904F2E mov eax, dword ptr fs:[00000030h] 9_2_04904F2E
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D8B58 mov eax, dword ptr fs:[00000030h] 9_2_049D8B58
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490F358 mov eax, dword ptr fs:[00000030h] 9_2_0490F358
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490DB40 mov eax, dword ptr fs:[00000030h] 9_2_0490DB40
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491EF40 mov eax, dword ptr fs:[00000030h] 9_2_0491EF40
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04933B7A mov eax, dword ptr fs:[00000030h] 9_2_04933B7A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_04933B7A mov eax, dword ptr fs:[00000030h] 9_2_04933B7A
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0490DB60 mov ecx, dword ptr fs:[00000030h] 9_2_0490DB60
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_0491FF60 mov eax, dword ptr fs:[00000030h] 9_2_0491FF60
Source: C:\Windows\SysWOW64\explorer.exe Code function: 9_2_049D8F6A mov eax, dword ptr fs:[00000030h] 9_2_049D8F6A
Checks if the current process is being debugged
Source: C:\Users\user\Desktop\new_order.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\new_order.exe Code function: 3_2_0040ACE0 LdrLoadDll, 3_2_0040ACE0

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.royalfountainlogistics.com
Source: C:\Windows\explorer.exe Network Connect: 3.64.163.50 80 Jump to behavior
Source: C:\Windows\explorer.exe Domain query: www.bitherders.com
Source: C:\Windows\explorer.exe Network Connect: 34.102.136.180 80 Jump to behavior
Sample uses process hollowing technique
Source: C:\Users\user\Desktop\new_order.exe Section unmapped: C:\Windows\SysWOW64\explorer.exe base address: 1160000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\new_order.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\new_order.exe Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\new_order.exe Section loaded: unknown target: C:\Windows\SysWOW64\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Injects a PE file into a foreign processes
Source: C:\Users\user\Desktop\new_order.exe Memory written: C:\Users\user\Desktop\new_order.exe base: 400000 value starts with: 4D5A Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\Desktop\new_order.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\Desktop\new_order.exe Thread register set: target process: 3424 Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Thread register set: target process: 3424 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\new_order.exe Process created: C:\Users\user\Desktop\new_order.exe "C:\Users\user\Desktop\new_order.exe" Jump to behavior
Source: C:\Windows\SysWOW64\explorer.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\Desktop\new_order.exe" Jump to behavior
Source: explorer.exe, 00000005.00000000.728348179.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.709064422.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.695157281.0000000000AD8000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: ProgmanMD6
Source: explorer.exe, 00000005.00000000.710184984.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.728572990.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.695317494.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Program Manager
Source: new_order.exe, 00000003.00000002.756328616.0000000002660000.00000040.10000000.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.710184984.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.728572990.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.717194149.0000000005E50000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.695317494.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000005.00000000.710184984.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.728572990.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.695317494.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: new_order.exe, 00000003.00000002.756328616.0000000002660000.00000040.10000000.00040000.00000000.sdmp Binary or memory string: Microsoft-Reserved-24C26ACC-DE62-4303-88AD-6CD4F1447F18SecurityConfigureWindowsPasswordsProxy DesktopProgmanSoftware\Microsoft\Windows NT\CurrentVersion\WinlogonShellSoftware\Microsoft\Windows NT\CurrentVersion\Winlogon\AlternateShells\AvailableShells
Source: explorer.exe, 00000005.00000000.710184984.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.728572990.0000000001080000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000005.00000000.695317494.0000000001080000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: explorer.exe, 00000005.00000000.701747574.000000000A716000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.720684965.000000000A716000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000005.00000000.736203145.000000000A716000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd5D
Source: C:\Users\user\Desktop\new_order.exe Code function: 1_2_00405AA7 GetVersion,GetSystemDirectoryA,GetWindowsDirectoryA,SHGetSpecialFolderLocation,SHGetPathFromIDListA,CoTaskMemFree,lstrcatA,lstrlenA, 1_2_00405AA7

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 3.0.new_order.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.new_order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.new_order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.new_order.exe.1acb0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.new_order.exe.1acb0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946218609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946443311.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.738390030.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.754910561.00000000004C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.688696186.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.723911761.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946503989.0000000000850000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.687734511.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.754825305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.755193140.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 3.0.new_order.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.new_order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.2.new_order.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 3.0.new_order.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.new_order.exe.1acb0000.2.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.new_order.exe.1acb0000.2.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000001.00000002.698671664.000000001ACB0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946218609.0000000000400000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946443311.0000000000820000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.738390030.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.754910561.00000000004C0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.688696186.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000000.723911761.000000000E954000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000009.00000002.946503989.0000000000850000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.687734511.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.754825305.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.755193140.00000000009F0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 562020 Sample: new_order.exe Startdate: 28/01/2022 Architecture: WINDOWS Score: 100 31 www.mydemosite0.com 2->31 33 mydemosite0.com 2->33 41 Snort IDS alert for network traffic (e.g. based on Emerging Threat rules) 2->41 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 6 other signatures 2->47 11 new_order.exe 19 2->11         started        signatures3 process4 file5 29 C:\Users\user\AppData\Local\...\yvucmw.dll, PE32 11->29 dropped 59 Found evasive API chain (may stop execution after reading information in the PEB, e.g. number of processors) 11->59 61 Tries to detect virtualization through RDTSC time measurements 11->61 63 Injects a PE file into a foreign processes 11->63 15 new_order.exe 11->15         started        signatures6 process7 signatures8 65 Modifies the context of a thread in another process (thread injection) 15->65 67 Maps a DLL or memory area into another process 15->67 69 Sample uses process hollowing technique 15->69 71 Queues an APC in another process (thread injection) 15->71 18 explorer.exe 15->18 injected process9 dnsIp10 35 www.bitherders.com 3.64.163.50, 49829, 80 AMAZON-02US United States 18->35 37 www.royalfountainlogistics.com 18->37 39 royalfountainlogistics.com 34.102.136.180, 49806, 80 GOOGLEUS United States 18->39 49 System process connects to network (likely due to code injection or exploit) 18->49 22 explorer.exe 18->22         started        signatures11 process12 signatures13 51 Self deletion via cmd delete 22->51 53 Modifies the context of a thread in another process (thread injection) 22->53 55 Maps a DLL or memory area into another process 22->55 57 Tries to detect virtualization through RDTSC time measurements 22->57 25 cmd.exe 1 22->25         started        process14 process15 27 conhost.exe 25->27         started       
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
34.102.136.180
 royalfountainlogistics.com United States
15169 GOOGLEUS false
3.64.163.50
 www.bitherders.com United States
16509 AMAZON-02US true

Contacted Domains

Name IP Active
mydemosite0.com 67.225.236.76 true
royalfountainlogistics.com 34.102.136.180 true
www.bitherders.com 3.64.163.50 true
www.royalfountainlogistics.com unknown unknown
www.mydemosite0.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.foodgw.com/os16/ true
  • Avira URL Cloud: malware
 low
http://www.bitherders.com/os16/?XL3pvD=wD4cT7q48NFnhCndHw9GtexQ1GWRT95jx29TDgoZhFSVm5lLt3bl1PAkaHfi4RiaXjL3&m0Dd=nFQHcLg0mfV8fj true
  • Avira URL Cloud: malware
 unknown
http://www.royalfountainlogistics.com/os16/?XL3pvD=fPwrUrgVvuqeO931Dg4gzzbtrd7thr2/NsJ/u9TrNiEyg4FeGnR3RlXi6kvbgSn2o0yC&m0Dd=nFQHcLg0mfV8fj false
  • Avira URL Cloud: safe
 unknown