Windows Analysis Report
Ay9xkK3NYN

Overview

General Information

Sample Name: Ay9xkK3NYN (renamed file extension from none to exe)
Analysis ID: 620775
MD5: 5fc986129c3d833b1c7e5ba6ff3678bc
SHA1: 2ace6bc0488df9b8592e25be3de38e6c9a0c16da
SHA256: d02d076842cc94fa6612b13ff0d2f77e1ff9150d22607cfe3962da4234cf4ed5
Tags: 32exeFormbooktrojan
Infos:

Detection

FormBook
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Found malware configuration
Multi AV Scanner detection for submitted file
Yara detected FormBook
Malicious sample detected (through community Yara rule)
System process connects to network (likely due to code injection or exploit)
Sample uses process hollowing technique
Maps a DLL or memory area into another process
Machine Learning detection for sample
Modifies the prolog of user mode functions (user mode inline hooks)
Queues an APC in another process (thread injection)
Tries to detect virtualization through RDTSC time measurements
Modifies the context of a thread in another process (thread injection)
C2 URLs / IPs found in malware configuration
Uses 32bit PE files
Yara signature match
Antivirus or Machine Learning detection for unpacked file
Contains functionality to shutdown / reboot the system
Uses code obfuscation techniques (call, push, ret)
Detected potential crypto function
Found potential string decryption / allocating functions
Sample execution stops while process was sleeping (likely an evasion)
Contains functionality to call native functions
Contains functionality for execution timing, often used to detect debuggers
Enables debug privileges
Found inlined nop instructions (likely shell or obfuscated code)
Drops PE files
Contains functionality to read the PEB
Checks if the current process is being debugged
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Dropped file seen in connection with other malware
Found large amount of non-executed APIs
Creates a process in suspended mode (likely to inject code)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality for read data from the clipboard

Classification

AV Detection
barindex
Found malware configuration
Source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp Malware Configuration Extractor: FormBook {"C2 list": ["www.shishlomarket24.biz/fw02/"], "decoy": ["payer-breakers.com", "thesiscoper.com", "rental-villa.com", "scovikinnovations.com", "hydh33.com", "allmyshit.rest", "lovejaclyn.com", "vanessaruizwriting.com", "dufonddelaclasse.com", "kiddee168.com", "monumentalmarketsllc.com", "musclegainfatloss.com", "avida.info", "cosmo-wellness.net", "dandelionfusedigital.com", "oversizeloadbanners.com", "konstelle.store", "sdjnsbd.com", "czoqg.xyz", "5p6xljjse1lq.xyz", "10936.loan", "primeiropasso.website", "salarydetector.net", "the6figureshow.com", "ritzluxurytransportation.com", "5145.design", "web3ido.xyz", "starweaverdesigns.com", "cbdtz.com", "sunwall.xyz", "ornitv.com", "curateddesignsconsulting.com", "businesshairways.biz", "willacloud.com", "accusecures.com", "hl243.com", "coffellc.icu", "eddrugs2018.com", "lidakang.xyz", "salesstorecolombia.com", "ilina.xyz", "partieslikethese.com", "peymantasnimi.com", "datthocu.xyz", "cybertechsolutions.xyz", "findy.guru", "trybes.space", "arulinks.com", "yuriookinoart.com", "largestjerseysstore.com", "fortitude-tech.com", "ywfjp.com", "b1v097f2avze.xyz", "abdullahnazhim.com", "zhaoav111.info", "cegrowing.com", "llaveselmuerto.com", "7477e.xyz", "chabusinessloans.com", "ht-brain.com", "app-compound.finance", "0085208.com", "wewinaccidents.com", "ztzfirst.xyz"]}
Multi AV Scanner detection for submitted file
Source: Ay9xkK3NYN.exe Virustotal: Detection: 37% Perma Link
Source: Ay9xkK3NYN.exe ReversingLabs: Detection: 42%
Yara detected FormBook
Source: Yara match File source: 2.0.rysgtozci.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rysgtozci.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.rysgtozci.exe.600000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.rysgtozci.exe.600000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rysgtozci.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.696256426.00000000048E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.553285992.00000000005B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.694897544.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.441965873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.491644734.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.695692167.00000000048B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.440397426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.552642858.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.516553688.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.445776431.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Machine Learning detection for sample
Source: Ay9xkK3NYN.exe Joe Sandbox ML: detected
Antivirus or Machine Learning detection for unpacked file
Source: 2.0.rysgtozci.exe.400000.6.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 1.2.rysgtozci.exe.600000.1.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.rysgtozci.exe.400000.5.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.0.rysgtozci.exe.400000.4.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Source: 2.2.rysgtozci.exe.400000.0.unpack Avira: Label: TR/Crypt.ZPACK.Gen
Uses 32bit PE files
Source: Ay9xkK3NYN.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Source: Ay9xkK3NYN.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: rysgtozci.exe, 00000001.00000003.442893277.0000000002390000.00000004.00001000.00020000.00000000.sdmp, rysgtozci.exe, 00000001.00000003.442019439.0000000002200000.00000004.00001000.00020000.00000000.sdmp, rysgtozci.exe, 00000002.00000002.555003506.0000000000BCF000.00000040.00000800.00020000.00000000.sdmp, rysgtozci.exe, 00000002.00000002.554734840.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000E.00000002.697178220.0000000004D50000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000E.00000002.698632878.0000000004E6F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: rysgtozci.exe, rysgtozci.exe, 00000002.00000002.555003506.0000000000BCF000.00000040.00000800.00020000.00000000.sdmp, rysgtozci.exe, 00000002.00000002.554734840.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, systray.exe, 0000000E.00000002.697178220.0000000004D50000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000E.00000002.698632878.0000000004E6F000.00000040.00000800.00020000.00000000.sdmp
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C13
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_0040683D FindFirstFileW,FindClose, 0_2_0040683D
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_0040290B FindFirstFileW, 0_2_0040290B
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 4x nop then pop esi 2_2_00417326
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 4x nop then pop ebx 2_2_00407B2D
Source: C:\Windows\SysWOW64\systray.exe Code function: 4x nop then pop ebx 14_2_00C87B2D
Source: C:\Windows\SysWOW64\systray.exe Code function: 4x nop then pop esi 14_2_00C97326

Networking
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.fortitude-tech.com
C2 URLs / IPs found in malware configuration
Source: Malware configuration extractor URLs: www.shishlomarket24.biz/fw02/
Tries to resolve domain names, but no domain seems valid (expired dropper behavior)
Source: unknown DNS traffic detected: query: www.fortitude-tech.com replaycode: Name error (3)
Source: Ay9xkK3NYN.exe String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: unknown DNS traffic detected: queries for: www.fortitude-tech.com
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_004056A8 GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,SendMessageW,CreatePopupMenu,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_004056A8

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 2.0.rysgtozci.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rysgtozci.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.rysgtozci.exe.600000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.rysgtozci.exe.600000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rysgtozci.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.696256426.00000000048E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.553285992.00000000005B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.694897544.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.441965873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.491644734.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.695692167.00000000048B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.440397426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.552642858.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.516553688.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.445776431.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 2.0.rysgtozci.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.rysgtozci.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.rysgtozci.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.rysgtozci.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.rysgtozci.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.rysgtozci.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.rysgtozci.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.rysgtozci.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.rysgtozci.exe.600000.1.raw.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.rysgtozci.exe.600000.1.raw.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 1.2.rysgtozci.exe.600000.1.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 1.2.rysgtozci.exe.600000.1.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.rysgtozci.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.rysgtozci.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.0.rysgtozci.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.0.rysgtozci.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 2.2.rysgtozci.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 2.2.rysgtozci.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.696256426.00000000048E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.696256426.00000000048E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.553285992.00000000005B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.553285992.00000000005B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.694897544.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.694897544.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.441965873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.441965873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.491644734.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.491644734.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 0000000E.00000002.695692167.00000000048B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 0000000E.00000002.695692167.00000000048B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000000.440397426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000000.440397426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000002.00000002.552642858.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000002.00000002.552642858.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000003.00000000.516553688.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000003.00000000.516553688.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Source: 00000001.00000002.445776431.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: autogenerated rule brought to you by yara-signator Author: Felix Bilstein - yara-signator at cocacoding dot com
Source: 00000001.00000002.445776431.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: detect Formbook in memory Author: JPCERT/CC Incident Response Group
Uses 32bit PE files
Source: Ay9xkK3NYN.exe Static PE information: LOCAL_SYMS_STRIPPED, 32BIT_MACHINE, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, RELOCS_STRIPPED
Yara signature match
Source: 2.0.rysgtozci.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.rysgtozci.exe.400000.6.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.rysgtozci.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.rysgtozci.exe.400000.0.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.rysgtozci.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.rysgtozci.exe.400000.5.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.rysgtozci.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.rysgtozci.exe.400000.6.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.rysgtozci.exe.600000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.rysgtozci.exe.600000.1.raw.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 1.2.rysgtozci.exe.600000.1.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 1.2.rysgtozci.exe.600000.1.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.rysgtozci.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.rysgtozci.exe.400000.5.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.0.rysgtozci.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.0.rysgtozci.exe.400000.4.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 2.2.rysgtozci.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 2.2.rysgtozci.exe.400000.0.unpack, type: UNPACKEDPE Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.696256426.00000000048E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.696256426.00000000048E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.553285992.00000000005B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.553285992.00000000005B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.694897544.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.694897544.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.441965873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.441965873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.491644734.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.491644734.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 0000000E.00000002.695692167.00000000048B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 0000000E.00000002.695692167.00000000048B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000000.440397426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000000.440397426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000002.00000002.552642858.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000002.00000002.552642858.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000003.00000000.516553688.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000003.00000000.516553688.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Source: 00000001.00000002.445776431.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook_1 date = 2018-11-23, author = Felix Bilstein - yara-signator at cocacoding dot com, malpedia_version = 20180607, description = autogenerated rule brought to you by yara-signator, malpedia_reference = https://malpedia.caad.fkie.fraunhofer.de/details/win.formbook, cape_type = Formbook Payload, malpedia_license = CC BY-NC-SA 4.0, version = 1, tool = yara-signator 0.1a, malpedia_sharing = TLP:WHITE
Source: 00000001.00000002.445776431.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY Matched rule: Formbook author = JPCERT/CC Incident Response Group, description = detect Formbook in memory, rule_usage = memory scan, reference = internal research
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004034F7
Detected potential crypto function
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_00406BFE 0_2_00406BFE
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00401026 2_2_00401026
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00401030 2_2_00401030
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041F033 2_2_0041F033
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041E2B8 2_2_0041E2B8
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041EBA7 2_2_0041EBA7
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041EBBD 2_2_0041EBBD
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00402D87 2_2_00402D87
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00402D90 2_2_00402D90
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041E5B3 2_2_0041E5B3
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041D658 2_2_0041D658
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00409E5D 2_2_00409E5D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00409E60 2_2_00409E60
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041EE0D 2_2_0041EE0D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041DE97 2_2_0041DE97
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00402FB0 2_2_00402FB0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B020A0 2_2_00B020A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA20A8 2_2_00BA20A8
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEB090 2_2_00AEB090
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA28EC 2_2_00BA28EC
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91002 2_2_00B91002
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF4120 2_2_00AF4120
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADF900 2_2_00ADF900
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA22AE 2_2_00BA22AE
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0EBB0 2_2_00B0EBB0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9DBD2 2_2_00B9DBD2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA2B28 2_2_00BA2B28
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE841F 2_2_00AE841F
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9D466 2_2_00B9D466
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02581 2_2_00B02581
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AED5E0 2_2_00AED5E0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA25DD 2_2_00BA25DD
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD0D20 2_2_00AD0D20
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA2D07 2_2_00BA2D07
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA1D55 2_2_00BA1D55
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA2EF7 2_2_00BA2EF7
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF6E30 2_2_00AF6E30
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9D616 2_2_00B9D616
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA1FF1 2_2_00BA1FF1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3D466 14_2_04E3D466
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8841F 14_2_04D8841F
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8D5E0 14_2_04D8D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E425DD 14_2_04E425DD
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA2581 14_2_04DA2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E41D55 14_2_04E41D55
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E42D07 14_2_04E42D07
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D70D20 14_2_04D70D20
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E42EF7 14_2_04E42EF7
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D96E30 14_2_04D96E30
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3D616 14_2_04E3D616
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E41FF1 14_2_04E41FF1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E4DFCE 14_2_04E4DFCE
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E428EC 14_2_04E428EC
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8B090 14_2_04D8B090
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E420A8 14_2_04E420A8
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA20A0 14_2_04DA20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E4E824 14_2_04E4E824
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31002 14_2_04E31002
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7F900 14_2_04D7F900
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D94120 14_2_04D94120
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E422AE 14_2_04E422AE
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E2FA2B 14_2_04E2FA2B
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3DBD2 14_2_04E3DBD2
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E303DA 14_2_04E303DA
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAEBB0 14_2_04DAEBB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E42B28 14_2_04E42B28
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9F033 14_2_00C9F033
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9EBA7 14_2_00C9EBA7
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9EBBD 14_2_00C9EBBD
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C82D87 14_2_00C82D87
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C82D90 14_2_00C82D90
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9E5B3 14_2_00C9E5B3
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C89E5D 14_2_00C89E5D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C89E60 14_2_00C89E60
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9EE0D 14_2_00C9EE0D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C82FB0 14_2_00C82FB0
Found potential string decryption / allocating functions
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: String function: 00ADB150 appears 35 times
Source: C:\Windows\SysWOW64\systray.exe Code function: String function: 04D7B150 appears 45 times
Contains functionality to call native functions
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041A360 NtCreateFile, 2_2_0041A360
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041A410 NtReadFile, 2_2_0041A410
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041A490 NtClose, 2_2_0041A490
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041A540 NtAllocateVirtualMemory, 2_2_0041A540
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041A40A NtReadFile, 2_2_0041A40A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041A48A NtClose, 2_2_0041A48A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041A53C NtAllocateVirtualMemory, 2_2_0041A53C
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B198F0 NtReadVirtualMemory,LdrInitializeThunk, 2_2_00B198F0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19860 NtQuerySystemInformation,LdrInitializeThunk, 2_2_00B19860
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19840 NtDelayExecution,LdrInitializeThunk, 2_2_00B19840
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B199A0 NtCreateSection,LdrInitializeThunk, 2_2_00B199A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19910 NtAdjustPrivilegesToken,LdrInitializeThunk, 2_2_00B19910
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19A20 NtResumeThread,LdrInitializeThunk, 2_2_00B19A20
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19A00 NtProtectVirtualMemory,LdrInitializeThunk, 2_2_00B19A00
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19A50 NtCreateFile,LdrInitializeThunk, 2_2_00B19A50
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B195D0 NtClose,LdrInitializeThunk, 2_2_00B195D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19540 NtReadFile,LdrInitializeThunk, 2_2_00B19540
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B196E0 NtFreeVirtualMemory,LdrInitializeThunk, 2_2_00B196E0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19660 NtAllocateVirtualMemory,LdrInitializeThunk, 2_2_00B19660
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B197A0 NtUnmapViewOfSection,LdrInitializeThunk, 2_2_00B197A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19780 NtMapViewOfSection,LdrInitializeThunk, 2_2_00B19780
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19710 NtQueryInformationToken,LdrInitializeThunk, 2_2_00B19710
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B198A0 NtWriteVirtualMemory, 2_2_00B198A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19820 NtEnumerateKey, 2_2_00B19820
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B1B040 NtSuspendThread, 2_2_00B1B040
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B199D0 NtCreateProcessEx, 2_2_00B199D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19950 NtQueueApcThread, 2_2_00B19950
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19A80 NtOpenDirectoryObject, 2_2_00B19A80
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19A10 NtQuerySection, 2_2_00B19A10
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B1A3B0 NtGetContextThread, 2_2_00B1A3B0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19B00 NtSetValueKey, 2_2_00B19B00
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B195F0 NtQueryInformationFile, 2_2_00B195F0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B1AD30 NtSetContextThread, 2_2_00B1AD30
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19520 NtWaitForSingleObject, 2_2_00B19520
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19560 NtWriteFile, 2_2_00B19560
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B196D0 NtCreateKey, 2_2_00B196D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19610 NtEnumerateValueKey, 2_2_00B19610
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19670 NtQueryInformationProcess, 2_2_00B19670
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19650 NtQueryValueKey, 2_2_00B19650
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19FE0 NtCreateMutant, 2_2_00B19FE0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19730 NtQueryVirtualMemory, 2_2_00B19730
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B1A710 NtOpenProcessToken, 2_2_00B1A710
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19770 NtSetInformationFile, 2_2_00B19770
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B1A770 NtOpenThread, 2_2_00B1A770
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B19760 NtOpenProcess, 2_2_00B19760
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB95D0 NtClose,LdrInitializeThunk, 14_2_04DB95D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9540 NtReadFile,LdrInitializeThunk, 14_2_04DB9540
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB96D0 NtCreateKey,LdrInitializeThunk, 14_2_04DB96D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB96E0 NtFreeVirtualMemory,LdrInitializeThunk, 14_2_04DB96E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9650 NtQueryValueKey,LdrInitializeThunk, 14_2_04DB9650
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9660 NtAllocateVirtualMemory,LdrInitializeThunk, 14_2_04DB9660
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9FE0 NtCreateMutant,LdrInitializeThunk, 14_2_04DB9FE0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9780 NtMapViewOfSection,LdrInitializeThunk, 14_2_04DB9780
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9710 NtQueryInformationToken,LdrInitializeThunk, 14_2_04DB9710
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9840 NtDelayExecution,LdrInitializeThunk, 14_2_04DB9840
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9860 NtQuerySystemInformation,LdrInitializeThunk, 14_2_04DB9860
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB99A0 NtCreateSection,LdrInitializeThunk, 14_2_04DB99A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9910 NtAdjustPrivilegesToken,LdrInitializeThunk, 14_2_04DB9910
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9A50 NtCreateFile,LdrInitializeThunk, 14_2_04DB9A50
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB95F0 NtQueryInformationFile, 14_2_04DB95F0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9560 NtWriteFile, 14_2_04DB9560
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DBAD30 NtSetContextThread, 14_2_04DBAD30
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9520 NtWaitForSingleObject, 14_2_04DB9520
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9670 NtQueryInformationProcess, 14_2_04DB9670
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9610 NtEnumerateValueKey, 14_2_04DB9610
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB97A0 NtUnmapViewOfSection, 14_2_04DB97A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DBA770 NtOpenThread, 14_2_04DBA770
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9770 NtSetInformationFile, 14_2_04DB9770
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9760 NtOpenProcess, 14_2_04DB9760
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DBA710 NtOpenProcessToken, 14_2_04DBA710
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9730 NtQueryVirtualMemory, 14_2_04DB9730
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB98F0 NtReadVirtualMemory, 14_2_04DB98F0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB98A0 NtWriteVirtualMemory, 14_2_04DB98A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DBB040 NtSuspendThread, 14_2_04DBB040
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9820 NtEnumerateKey, 14_2_04DB9820
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB99D0 NtCreateProcessEx, 14_2_04DB99D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9950 NtQueueApcThread, 14_2_04DB9950
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9A80 NtOpenDirectoryObject, 14_2_04DB9A80
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9A10 NtQuerySection, 14_2_04DB9A10
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9A00 NtProtectVirtualMemory, 14_2_04DB9A00
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9A20 NtResumeThread, 14_2_04DB9A20
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DBA3B0 NtGetContextThread, 14_2_04DBA3B0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB9B00 NtSetValueKey, 14_2_04DB9B00
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9A360 NtCreateFile, 14_2_00C9A360
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9A490 NtClose, 14_2_00C9A490
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9A410 NtReadFile, 14_2_00C9A410
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9A540 NtAllocateVirtualMemory, 14_2_00C9A540
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9A48A NtClose, 14_2_00C9A48A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9A40A NtReadFile, 14_2_00C9A40A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9A53C NtAllocateVirtualMemory, 14_2_00C9A53C
Dropped file seen in connection with other malware
Source: Joe Sandbox View Dropped File: C:\Users\user\AppData\Local\Temp\rysgtozci.exe 874F73E2673462859967AFC64C3C33C1957D7B69915124CCA91CED26DCFCD5C0
Source: Ay9xkK3NYN.exe Virustotal: Detection: 37%
Source: Ay9xkK3NYN.exe ReversingLabs: Detection: 42%
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe File read: C:\Users\user\Desktop\Ay9xkK3NYN.exe Jump to behavior
Source: Ay9xkK3NYN.exe Static PE information: Section: .text IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\Ay9xkK3NYN.exe "C:\Users\user\Desktop\Ay9xkK3NYN.exe"
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Process created: C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\wduqqtzg
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Process created: C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\wduqqtzg
Source: C:\Windows\explorer.exe Process created: C:\Windows\SysWOW64\systray.exe C:\Windows\SysWOW64\systray.exe
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\rysgtozci.exe"
Source: C:\Windows\SysWOW64\cmd.exe Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Process created: C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\wduqqtzg Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Process created: C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\wduqqtzg Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\rysgtozci.exe" Jump to behavior
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004034F7
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe File created: C:\Users\user\AppData\Local\Temp\nsb28F1.tmp Jump to behavior
Source: classification engine Classification label: mal100.troj.evad.winEXE@9/3@1/0
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_004021AA CoCreateInstance, 0_2_004021AA
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_00404954 GetDlgItem,SetWindowTextW,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_00404954
Source: C:\Windows\System32\conhost.exe Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:6652:120:WilError_01
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: C:\Windows\explorer.exe File read: C:\Windows\System32\drivers\etc\hosts Jump to behavior
Source: Ay9xkK3NYN.exe Static PE information: NO_SEH, TERMINAL_SERVER_AWARE, DYNAMIC_BASE, NX_COMPAT
Source: Binary string: wntdll.pdbUGP source: rysgtozci.exe, 00000001.00000003.442893277.0000000002390000.00000004.00001000.00020000.00000000.sdmp, rysgtozci.exe, 00000001.00000003.442019439.0000000002200000.00000004.00001000.00020000.00000000.sdmp, rysgtozci.exe, 00000002.00000002.555003506.0000000000BCF000.00000040.00000800.00020000.00000000.sdmp, rysgtozci.exe, 00000002.00000002.554734840.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000E.00000002.697178220.0000000004D50000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000E.00000002.698632878.0000000004E6F000.00000040.00000800.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: rysgtozci.exe, rysgtozci.exe, 00000002.00000002.555003506.0000000000BCF000.00000040.00000800.00020000.00000000.sdmp, rysgtozci.exe, 00000002.00000002.554734840.0000000000AB0000.00000040.00000800.00020000.00000000.sdmp, systray.exe, systray.exe, 0000000E.00000002.697178220.0000000004D50000.00000040.00000800.00020000.00000000.sdmp, systray.exe, 0000000E.00000002.698632878.0000000004E6F000.00000040.00000800.00020000.00000000.sdmp
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041AA66 push ds; ret 2_2_0041AA6D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0040E29C push ds; ret 2_2_0040E2B3
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041D4B5 push eax; ret 2_2_0041D508
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041D56C push eax; ret 2_2_0041D572
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041D502 push eax; ret 2_2_0041D508
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041D50B push eax; ret 2_2_0041D572
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0041BD3A push esp; retf 8B55h 2_2_0041BD3F
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B2D0D1 push ecx; ret 2_2_00B2D0E4
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DCD0D1 push ecx; ret 14_2_04DCD0E4
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C8E29C push ds; ret 14_2_00C8E2B3
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9AA66 push ds; ret 14_2_00C9AA6D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9D4B5 push eax; ret 14_2_00C9D508
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9D56C push eax; ret 14_2_00C9D572
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9D50B push eax; ret 14_2_00C9D572
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9D502 push eax; ret 14_2_00C9D508
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_00C9BD3A push esp; retf 8B55h 14_2_00C9BD3F
Drops PE files
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe File created: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Jump to dropped file

Hooking and other Techniques for Hiding and Protection
barindex
Modifies the prolog of user mode functions (user mode inline hooks)
Source: explorer.exe User mode code has changed: module: user32.dll function: PeekMessageA new code: 0x48 0x8B 0xB8 0x8F 0xFE 0xEA
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\explorer.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior

Malware Analysis System Evasion
barindex
Tries to detect virtualization through RDTSC time measurements
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe RDTSC instruction interceptor: First address: 0000000000409904 second address: 000000000040990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe RDTSC instruction interceptor: First address: 0000000000409B7E second address: 0000000000409B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe RDTSC instruction interceptor: First address: 0000000000C89904 second address: 0000000000C8990A instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Source: C:\Windows\SysWOW64\systray.exe RDTSC instruction interceptor: First address: 0000000000C89B7E second address: 0000000000C89B84 instructions: 0x00000000 rdtsc 0x00000002 xor ecx, ecx 0x00000004 add ecx, eax 0x00000006 rdtsc
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\explorer.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\systray.exe Last function: Thread delayed
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00409AB0 rdtsc 2_2_00409AB0
Found large amount of non-executed APIs
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe API coverage: 8.6 %
Source: C:\Windows\SysWOW64\systray.exe API coverage: 9.2 %
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Process information queried: ProcessInformation Jump to behavior
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_00405C13 GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_00405C13
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_0040683D FindFirstFileW,FindClose, 0_2_0040683D
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_0040290B FindFirstFileW, 0_2_0040290B
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe API call chain: ExitProcess graph end node
Source: explorer.exe, 00000003.00000000.487656419.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\Disk&Ven_VMware&Prod_Virtual_disk\5&1ec51bf7&0&000000
Source: explorer.exe, 00000003.00000000.488122847.000000000807B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}8Ll/
Source: explorer.exe, 00000003.00000000.488122847.000000000807B000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\scsi#cdrom&ven_necvmwar&prod_vmware_sata_cd00#5&280b647&0&000000#{53f56308-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.487656419.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: VMware SATA CD00
Source: explorer.exe, 00000003.00000000.455819230.0000000006915000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#5&280b647&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}
Source: explorer.exe, 00000003.00000000.469579569.00000000080B1000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CDROM&VEN_NECVMWAR&PROD_VMWARE_SATA_CD00\5&280B647&0&000000
Source: explorer.exe, 00000003.00000000.487656419.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: SCSI\CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00\5&280b647&0&000000
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00409AB0 rdtsc 2_2_00409AB0
Enables debug privileges
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Process token adjusted: Debug Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process token adjusted: Debug Jump to behavior
Contains functionality to read the PEB
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0F0BF mov ecx, dword ptr fs:[00000030h] 2_2_00B0F0BF
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0F0BF mov eax, dword ptr fs:[00000030h] 2_2_00B0F0BF
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0F0BF mov eax, dword ptr fs:[00000030h] 2_2_00B0F0BF
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h] 2_2_00B020A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h] 2_2_00B020A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h] 2_2_00B020A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h] 2_2_00B020A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h] 2_2_00B020A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B020A0 mov eax, dword ptr fs:[00000030h] 2_2_00B020A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B190AF mov eax, dword ptr fs:[00000030h] 2_2_00B190AF
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD9080 mov eax, dword ptr fs:[00000030h] 2_2_00AD9080
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B53884 mov eax, dword ptr fs:[00000030h] 2_2_00B53884
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B53884 mov eax, dword ptr fs:[00000030h] 2_2_00B53884
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD58EC mov eax, dword ptr fs:[00000030h] 2_2_00AD58EC
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B6B8D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6B8D0 mov ecx, dword ptr fs:[00000030h] 2_2_00B6B8D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B6B8D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B6B8D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B6B8D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6B8D0 mov eax, dword ptr fs:[00000030h] 2_2_00B6B8D0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEB02A mov eax, dword ptr fs:[00000030h] 2_2_00AEB02A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEB02A mov eax, dword ptr fs:[00000030h] 2_2_00AEB02A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEB02A mov eax, dword ptr fs:[00000030h] 2_2_00AEB02A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEB02A mov eax, dword ptr fs:[00000030h] 2_2_00AEB02A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h] 2_2_00B0002D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h] 2_2_00B0002D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h] 2_2_00B0002D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h] 2_2_00B0002D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0002D mov eax, dword ptr fs:[00000030h] 2_2_00B0002D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B57016 mov eax, dword ptr fs:[00000030h] 2_2_00B57016
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B57016 mov eax, dword ptr fs:[00000030h] 2_2_00B57016
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B57016 mov eax, dword ptr fs:[00000030h] 2_2_00B57016
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA4015 mov eax, dword ptr fs:[00000030h] 2_2_00BA4015
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA4015 mov eax, dword ptr fs:[00000030h] 2_2_00BA4015
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B92073 mov eax, dword ptr fs:[00000030h] 2_2_00B92073
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA1074 mov eax, dword ptr fs:[00000030h] 2_2_00BA1074
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF0050 mov eax, dword ptr fs:[00000030h] 2_2_00AF0050
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF0050 mov eax, dword ptr fs:[00000030h] 2_2_00AF0050
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B551BE mov eax, dword ptr fs:[00000030h] 2_2_00B551BE
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B551BE mov eax, dword ptr fs:[00000030h] 2_2_00B551BE
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B551BE mov eax, dword ptr fs:[00000030h] 2_2_00B551BE
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B551BE mov eax, dword ptr fs:[00000030h] 2_2_00B551BE
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B061A0 mov eax, dword ptr fs:[00000030h] 2_2_00B061A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B061A0 mov eax, dword ptr fs:[00000030h] 2_2_00B061A0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B569A6 mov eax, dword ptr fs:[00000030h] 2_2_00B569A6
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02990 mov eax, dword ptr fs:[00000030h] 2_2_00B02990
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFC182 mov eax, dword ptr fs:[00000030h] 2_2_00AFC182
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0A185 mov eax, dword ptr fs:[00000030h] 2_2_00B0A185
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00ADB1E1
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00ADB1E1
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADB1E1 mov eax, dword ptr fs:[00000030h] 2_2_00ADB1E1
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B641E8 mov eax, dword ptr fs:[00000030h] 2_2_00B641E8
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0513A mov eax, dword ptr fs:[00000030h] 2_2_00B0513A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0513A mov eax, dword ptr fs:[00000030h] 2_2_00B0513A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF4120 mov eax, dword ptr fs:[00000030h] 2_2_00AF4120
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF4120 mov eax, dword ptr fs:[00000030h] 2_2_00AF4120
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF4120 mov eax, dword ptr fs:[00000030h] 2_2_00AF4120
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF4120 mov eax, dword ptr fs:[00000030h] 2_2_00AF4120
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF4120 mov ecx, dword ptr fs:[00000030h] 2_2_00AF4120
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD9100 mov eax, dword ptr fs:[00000030h] 2_2_00AD9100
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD9100 mov eax, dword ptr fs:[00000030h] 2_2_00AD9100
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD9100 mov eax, dword ptr fs:[00000030h] 2_2_00AD9100
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADC962 mov eax, dword ptr fs:[00000030h] 2_2_00ADC962
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADB171 mov eax, dword ptr fs:[00000030h] 2_2_00ADB171
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADB171 mov eax, dword ptr fs:[00000030h] 2_2_00ADB171
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFB944 mov eax, dword ptr fs:[00000030h] 2_2_00AFB944
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFB944 mov eax, dword ptr fs:[00000030h] 2_2_00AFB944
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0FAB0 mov eax, dword ptr fs:[00000030h] 2_2_00B0FAB0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AD52A5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AD52A5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AD52A5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AD52A5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD52A5 mov eax, dword ptr fs:[00000030h] 2_2_00AD52A5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEAAB0 mov eax, dword ptr fs:[00000030h] 2_2_00AEAAB0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEAAB0 mov eax, dword ptr fs:[00000030h] 2_2_00AEAAB0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0D294 mov eax, dword ptr fs:[00000030h] 2_2_00B0D294
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0D294 mov eax, dword ptr fs:[00000030h] 2_2_00B0D294
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02AE4 mov eax, dword ptr fs:[00000030h] 2_2_00B02AE4
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02ACB mov eax, dword ptr fs:[00000030h] 2_2_00B02ACB
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B14A2C mov eax, dword ptr fs:[00000030h] 2_2_00B14A2C
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B14A2C mov eax, dword ptr fs:[00000030h] 2_2_00B14A2C
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE8A0A mov eax, dword ptr fs:[00000030h] 2_2_00AE8A0A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9AA16 mov eax, dword ptr fs:[00000030h] 2_2_00B9AA16
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9AA16 mov eax, dword ptr fs:[00000030h] 2_2_00B9AA16
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF3A1C mov eax, dword ptr fs:[00000030h] 2_2_00AF3A1C
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADAA16 mov eax, dword ptr fs:[00000030h] 2_2_00ADAA16
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADAA16 mov eax, dword ptr fs:[00000030h] 2_2_00ADAA16
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD5210 mov eax, dword ptr fs:[00000030h] 2_2_00AD5210
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD5210 mov ecx, dword ptr fs:[00000030h] 2_2_00AD5210
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD5210 mov eax, dword ptr fs:[00000030h] 2_2_00AD5210
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD5210 mov eax, dword ptr fs:[00000030h] 2_2_00AD5210
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B1927A mov eax, dword ptr fs:[00000030h] 2_2_00B1927A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B8B260 mov eax, dword ptr fs:[00000030h] 2_2_00B8B260
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B8B260 mov eax, dword ptr fs:[00000030h] 2_2_00B8B260
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA8A62 mov eax, dword ptr fs:[00000030h] 2_2_00BA8A62
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B64257 mov eax, dword ptr fs:[00000030h] 2_2_00B64257
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9EA55 mov eax, dword ptr fs:[00000030h] 2_2_00B9EA55
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD9240 mov eax, dword ptr fs:[00000030h] 2_2_00AD9240
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD9240 mov eax, dword ptr fs:[00000030h] 2_2_00AD9240
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD9240 mov eax, dword ptr fs:[00000030h] 2_2_00AD9240
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD9240 mov eax, dword ptr fs:[00000030h] 2_2_00AD9240
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B04BAD mov eax, dword ptr fs:[00000030h] 2_2_00B04BAD
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B04BAD mov eax, dword ptr fs:[00000030h] 2_2_00B04BAD
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B04BAD mov eax, dword ptr fs:[00000030h] 2_2_00B04BAD
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA5BA5 mov eax, dword ptr fs:[00000030h] 2_2_00BA5BA5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0B390 mov eax, dword ptr fs:[00000030h] 2_2_00B0B390
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE1B8F mov eax, dword ptr fs:[00000030h] 2_2_00AE1B8F
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE1B8F mov eax, dword ptr fs:[00000030h] 2_2_00AE1B8F
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02397 mov eax, dword ptr fs:[00000030h] 2_2_00B02397
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9138A mov eax, dword ptr fs:[00000030h] 2_2_00B9138A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B8D380 mov ecx, dword ptr fs:[00000030h] 2_2_00B8D380
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFDBE9 mov eax, dword ptr fs:[00000030h] 2_2_00AFDBE9
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h] 2_2_00B003E2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h] 2_2_00B003E2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h] 2_2_00B003E2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h] 2_2_00B003E2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h] 2_2_00B003E2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B003E2 mov eax, dword ptr fs:[00000030h] 2_2_00B003E2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B553CA mov eax, dword ptr fs:[00000030h] 2_2_00B553CA
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B553CA mov eax, dword ptr fs:[00000030h] 2_2_00B553CA
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9131B mov eax, dword ptr fs:[00000030h] 2_2_00B9131B
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B03B7A mov eax, dword ptr fs:[00000030h] 2_2_00B03B7A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B03B7A mov eax, dword ptr fs:[00000030h] 2_2_00B03B7A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADDB60 mov ecx, dword ptr fs:[00000030h] 2_2_00ADDB60
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA8B58 mov eax, dword ptr fs:[00000030h] 2_2_00BA8B58
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADDB40 mov eax, dword ptr fs:[00000030h] 2_2_00ADDB40
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADF358 mov eax, dword ptr fs:[00000030h] 2_2_00ADF358
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE849B mov eax, dword ptr fs:[00000030h] 2_2_00AE849B
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B914FB mov eax, dword ptr fs:[00000030h] 2_2_00B914FB
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56CF0 mov eax, dword ptr fs:[00000030h] 2_2_00B56CF0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56CF0 mov eax, dword ptr fs:[00000030h] 2_2_00B56CF0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56CF0 mov eax, dword ptr fs:[00000030h] 2_2_00B56CF0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA8CD6 mov eax, dword ptr fs:[00000030h] 2_2_00BA8CD6
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0BC2C mov eax, dword ptr fs:[00000030h] 2_2_00B0BC2C
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA740D mov eax, dword ptr fs:[00000030h] 2_2_00BA740D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA740D mov eax, dword ptr fs:[00000030h] 2_2_00BA740D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA740D mov eax, dword ptr fs:[00000030h] 2_2_00BA740D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91C06 mov eax, dword ptr fs:[00000030h] 2_2_00B91C06
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56C0A mov eax, dword ptr fs:[00000030h] 2_2_00B56C0A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56C0A mov eax, dword ptr fs:[00000030h] 2_2_00B56C0A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56C0A mov eax, dword ptr fs:[00000030h] 2_2_00B56C0A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56C0A mov eax, dword ptr fs:[00000030h] 2_2_00B56C0A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF746D mov eax, dword ptr fs:[00000030h] 2_2_00AF746D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6C450 mov eax, dword ptr fs:[00000030h] 2_2_00B6C450
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6C450 mov eax, dword ptr fs:[00000030h] 2_2_00B6C450
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0A44B mov eax, dword ptr fs:[00000030h] 2_2_00B0A44B
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B01DB5 mov eax, dword ptr fs:[00000030h] 2_2_00B01DB5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B01DB5 mov eax, dword ptr fs:[00000030h] 2_2_00B01DB5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B01DB5 mov eax, dword ptr fs:[00000030h] 2_2_00B01DB5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B035A1 mov eax, dword ptr fs:[00000030h] 2_2_00B035A1
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA05AC mov eax, dword ptr fs:[00000030h] 2_2_00BA05AC
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA05AC mov eax, dword ptr fs:[00000030h] 2_2_00BA05AC
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AD2D8A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AD2D8A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AD2D8A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AD2D8A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD2D8A mov eax, dword ptr fs:[00000030h] 2_2_00AD2D8A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0FD9B mov eax, dword ptr fs:[00000030h] 2_2_00B0FD9B
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0FD9B mov eax, dword ptr fs:[00000030h] 2_2_00B0FD9B
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02581 mov eax, dword ptr fs:[00000030h] 2_2_00B02581
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02581 mov eax, dword ptr fs:[00000030h] 2_2_00B02581
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02581 mov eax, dword ptr fs:[00000030h] 2_2_00B02581
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B02581 mov eax, dword ptr fs:[00000030h] 2_2_00B02581
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B88DF1 mov eax, dword ptr fs:[00000030h] 2_2_00B88DF1
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AED5E0 mov eax, dword ptr fs:[00000030h] 2_2_00AED5E0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AED5E0 mov eax, dword ptr fs:[00000030h] 2_2_00AED5E0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00B9FDE2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00B9FDE2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00B9FDE2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9FDE2 mov eax, dword ptr fs:[00000030h] 2_2_00B9FDE2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B56DC9
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B56DC9
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B56DC9
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56DC9 mov ecx, dword ptr fs:[00000030h] 2_2_00B56DC9
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B56DC9
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B56DC9 mov eax, dword ptr fs:[00000030h] 2_2_00B56DC9
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9E539 mov eax, dword ptr fs:[00000030h] 2_2_00B9E539
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B5A537 mov eax, dword ptr fs:[00000030h] 2_2_00B5A537
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B04D3B mov eax, dword ptr fs:[00000030h] 2_2_00B04D3B
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B04D3B mov eax, dword ptr fs:[00000030h] 2_2_00B04D3B
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B04D3B mov eax, dword ptr fs:[00000030h] 2_2_00B04D3B
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA8D34 mov eax, dword ptr fs:[00000030h] 2_2_00BA8D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE3D34 mov eax, dword ptr fs:[00000030h] 2_2_00AE3D34
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADAD30 mov eax, dword ptr fs:[00000030h] 2_2_00ADAD30
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFC577 mov eax, dword ptr fs:[00000030h] 2_2_00AFC577
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFC577 mov eax, dword ptr fs:[00000030h] 2_2_00AFC577
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B13D43 mov eax, dword ptr fs:[00000030h] 2_2_00B13D43
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B53540 mov eax, dword ptr fs:[00000030h] 2_2_00B53540
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AF7D50 mov eax, dword ptr fs:[00000030h] 2_2_00AF7D50
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B546A7 mov eax, dword ptr fs:[00000030h] 2_2_00B546A7
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA0EA5 mov eax, dword ptr fs:[00000030h] 2_2_00BA0EA5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA0EA5 mov eax, dword ptr fs:[00000030h] 2_2_00BA0EA5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA0EA5 mov eax, dword ptr fs:[00000030h] 2_2_00BA0EA5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6FE87 mov eax, dword ptr fs:[00000030h] 2_2_00B6FE87
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE76E2 mov eax, dword ptr fs:[00000030h] 2_2_00AE76E2
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B016E0 mov ecx, dword ptr fs:[00000030h] 2_2_00B016E0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA8ED6 mov eax, dword ptr fs:[00000030h] 2_2_00BA8ED6
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B18EC7 mov eax, dword ptr fs:[00000030h] 2_2_00B18EC7
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B8FEC0 mov eax, dword ptr fs:[00000030h] 2_2_00B8FEC0
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B036CC mov eax, dword ptr fs:[00000030h] 2_2_00B036CC
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B8FE3F mov eax, dword ptr fs:[00000030h] 2_2_00B8FE3F
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADE620 mov eax, dword ptr fs:[00000030h] 2_2_00ADE620
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0A61C mov eax, dword ptr fs:[00000030h] 2_2_00B0A61C
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0A61C mov eax, dword ptr fs:[00000030h] 2_2_00B0A61C
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADC600 mov eax, dword ptr fs:[00000030h] 2_2_00ADC600
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADC600 mov eax, dword ptr fs:[00000030h] 2_2_00ADC600
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00ADC600 mov eax, dword ptr fs:[00000030h] 2_2_00ADC600
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B08E00 mov eax, dword ptr fs:[00000030h] 2_2_00B08E00
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B91608 mov eax, dword ptr fs:[00000030h] 2_2_00B91608
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE766D mov eax, dword ptr fs:[00000030h] 2_2_00AE766D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h] 2_2_00AFAE73
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h] 2_2_00AFAE73
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h] 2_2_00AFAE73
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h] 2_2_00AFAE73
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFAE73 mov eax, dword ptr fs:[00000030h] 2_2_00AFAE73
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AE7E41
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AE7E41
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AE7E41
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AE7E41
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AE7E41
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE7E41 mov eax, dword ptr fs:[00000030h] 2_2_00AE7E41
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9AE44 mov eax, dword ptr fs:[00000030h] 2_2_00B9AE44
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B9AE44 mov eax, dword ptr fs:[00000030h] 2_2_00B9AE44
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B57794 mov eax, dword ptr fs:[00000030h] 2_2_00B57794
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B57794 mov eax, dword ptr fs:[00000030h] 2_2_00B57794
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B57794 mov eax, dword ptr fs:[00000030h] 2_2_00B57794
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AE8794 mov eax, dword ptr fs:[00000030h] 2_2_00AE8794
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B137F5 mov eax, dword ptr fs:[00000030h] 2_2_00B137F5
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0E730 mov eax, dword ptr fs:[00000030h] 2_2_00B0E730
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD4F2E mov eax, dword ptr fs:[00000030h] 2_2_00AD4F2E
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AD4F2E mov eax, dword ptr fs:[00000030h] 2_2_00AD4F2E
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6FF10 mov eax, dword ptr fs:[00000030h] 2_2_00B6FF10
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B6FF10 mov eax, dword ptr fs:[00000030h] 2_2_00B6FF10
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA070D mov eax, dword ptr fs:[00000030h] 2_2_00BA070D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA070D mov eax, dword ptr fs:[00000030h] 2_2_00BA070D
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AFF716 mov eax, dword ptr fs:[00000030h] 2_2_00AFF716
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0A70E mov eax, dword ptr fs:[00000030h] 2_2_00B0A70E
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00B0A70E mov eax, dword ptr fs:[00000030h] 2_2_00B0A70E
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEFF60 mov eax, dword ptr fs:[00000030h] 2_2_00AEFF60
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00BA8F6A mov eax, dword ptr fs:[00000030h] 2_2_00BA8F6A
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_00AEEF40 mov eax, dword ptr fs:[00000030h] 2_2_00AEEF40
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E314FB mov eax, dword ptr fs:[00000030h] 14_2_04E314FB
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6CF0 mov eax, dword ptr fs:[00000030h] 14_2_04DF6CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6CF0 mov eax, dword ptr fs:[00000030h] 14_2_04DF6CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6CF0 mov eax, dword ptr fs:[00000030h] 14_2_04DF6CF0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E48CD6 mov eax, dword ptr fs:[00000030h] 14_2_04E48CD6
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8849B mov eax, dword ptr fs:[00000030h] 14_2_04D8849B
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAA44B mov eax, dword ptr fs:[00000030h] 14_2_04DAA44B
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0C450 mov eax, dword ptr fs:[00000030h] 14_2_04E0C450
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0C450 mov eax, dword ptr fs:[00000030h] 14_2_04E0C450
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9746D mov eax, dword ptr fs:[00000030h] 14_2_04D9746D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6C0A mov eax, dword ptr fs:[00000030h] 14_2_04DF6C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6C0A mov eax, dword ptr fs:[00000030h] 14_2_04DF6C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6C0A mov eax, dword ptr fs:[00000030h] 14_2_04DF6C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6C0A mov eax, dword ptr fs:[00000030h] 14_2_04DF6C0A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31C06 mov eax, dword ptr fs:[00000030h] 14_2_04E31C06
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E4740D mov eax, dword ptr fs:[00000030h] 14_2_04E4740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E4740D mov eax, dword ptr fs:[00000030h] 14_2_04E4740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E4740D mov eax, dword ptr fs:[00000030h] 14_2_04E4740D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DABC2C mov eax, dword ptr fs:[00000030h] 14_2_04DABC2C
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3FDE2 mov eax, dword ptr fs:[00000030h] 14_2_04E3FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3FDE2 mov eax, dword ptr fs:[00000030h] 14_2_04E3FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3FDE2 mov eax, dword ptr fs:[00000030h] 14_2_04E3FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3FDE2 mov eax, dword ptr fs:[00000030h] 14_2_04E3FDE2
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E28DF1 mov eax, dword ptr fs:[00000030h] 14_2_04E28DF1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6DC9 mov eax, dword ptr fs:[00000030h] 14_2_04DF6DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6DC9 mov eax, dword ptr fs:[00000030h] 14_2_04DF6DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6DC9 mov eax, dword ptr fs:[00000030h] 14_2_04DF6DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6DC9 mov ecx, dword ptr fs:[00000030h] 14_2_04DF6DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6DC9 mov eax, dword ptr fs:[00000030h] 14_2_04DF6DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF6DC9 mov eax, dword ptr fs:[00000030h] 14_2_04DF6DC9
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8D5E0 mov eax, dword ptr fs:[00000030h] 14_2_04D8D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8D5E0 mov eax, dword ptr fs:[00000030h] 14_2_04D8D5E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAFD9B mov eax, dword ptr fs:[00000030h] 14_2_04DAFD9B
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAFD9B mov eax, dword ptr fs:[00000030h] 14_2_04DAFD9B
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E405AC mov eax, dword ptr fs:[00000030h] 14_2_04E405AC
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E405AC mov eax, dword ptr fs:[00000030h] 14_2_04E405AC
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA2581 mov eax, dword ptr fs:[00000030h] 14_2_04DA2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA2581 mov eax, dword ptr fs:[00000030h] 14_2_04DA2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA2581 mov eax, dword ptr fs:[00000030h] 14_2_04DA2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA2581 mov eax, dword ptr fs:[00000030h] 14_2_04DA2581
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D72D8A mov eax, dword ptr fs:[00000030h] 14_2_04D72D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D72D8A mov eax, dword ptr fs:[00000030h] 14_2_04D72D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D72D8A mov eax, dword ptr fs:[00000030h] 14_2_04D72D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D72D8A mov eax, dword ptr fs:[00000030h] 14_2_04D72D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D72D8A mov eax, dword ptr fs:[00000030h] 14_2_04D72D8A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA1DB5 mov eax, dword ptr fs:[00000030h] 14_2_04DA1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA1DB5 mov eax, dword ptr fs:[00000030h] 14_2_04DA1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA1DB5 mov eax, dword ptr fs:[00000030h] 14_2_04DA1DB5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA35A1 mov eax, dword ptr fs:[00000030h] 14_2_04DA35A1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D97D50 mov eax, dword ptr fs:[00000030h] 14_2_04D97D50
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB3D43 mov eax, dword ptr fs:[00000030h] 14_2_04DB3D43
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF3540 mov eax, dword ptr fs:[00000030h] 14_2_04DF3540
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E23D40 mov eax, dword ptr fs:[00000030h] 14_2_04E23D40
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9C577 mov eax, dword ptr fs:[00000030h] 14_2_04D9C577
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9C577 mov eax, dword ptr fs:[00000030h] 14_2_04D9C577
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E48D34 mov eax, dword ptr fs:[00000030h] 14_2_04E48D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3E539 mov eax, dword ptr fs:[00000030h] 14_2_04E3E539
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA4D3B mov eax, dword ptr fs:[00000030h] 14_2_04DA4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA4D3B mov eax, dword ptr fs:[00000030h] 14_2_04DA4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA4D3B mov eax, dword ptr fs:[00000030h] 14_2_04DA4D3B
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7AD30 mov eax, dword ptr fs:[00000030h] 14_2_04D7AD30
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DFA537 mov eax, dword ptr fs:[00000030h] 14_2_04DFA537
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D83D34 mov eax, dword ptr fs:[00000030h] 14_2_04D83D34
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA36CC mov eax, dword ptr fs:[00000030h] 14_2_04DA36CC
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB8EC7 mov eax, dword ptr fs:[00000030h] 14_2_04DB8EC7
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E2FEC0 mov eax, dword ptr fs:[00000030h] 14_2_04E2FEC0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E48ED6 mov eax, dword ptr fs:[00000030h] 14_2_04E48ED6
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA16E0 mov ecx, dword ptr fs:[00000030h] 14_2_04DA16E0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D876E2 mov eax, dword ptr fs:[00000030h] 14_2_04D876E2
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E40EA5 mov eax, dword ptr fs:[00000030h] 14_2_04E40EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E40EA5 mov eax, dword ptr fs:[00000030h] 14_2_04E40EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E40EA5 mov eax, dword ptr fs:[00000030h] 14_2_04E40EA5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0FE87 mov eax, dword ptr fs:[00000030h] 14_2_04E0FE87
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF46A7 mov eax, dword ptr fs:[00000030h] 14_2_04DF46A7
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D87E41 mov eax, dword ptr fs:[00000030h] 14_2_04D87E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D87E41 mov eax, dword ptr fs:[00000030h] 14_2_04D87E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D87E41 mov eax, dword ptr fs:[00000030h] 14_2_04D87E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D87E41 mov eax, dword ptr fs:[00000030h] 14_2_04D87E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D87E41 mov eax, dword ptr fs:[00000030h] 14_2_04D87E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D87E41 mov eax, dword ptr fs:[00000030h] 14_2_04D87E41
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3AE44 mov eax, dword ptr fs:[00000030h] 14_2_04E3AE44
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E3AE44 mov eax, dword ptr fs:[00000030h] 14_2_04E3AE44
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9AE73 mov eax, dword ptr fs:[00000030h] 14_2_04D9AE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9AE73 mov eax, dword ptr fs:[00000030h] 14_2_04D9AE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9AE73 mov eax, dword ptr fs:[00000030h] 14_2_04D9AE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9AE73 mov eax, dword ptr fs:[00000030h] 14_2_04D9AE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9AE73 mov eax, dword ptr fs:[00000030h] 14_2_04D9AE73
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8766D mov eax, dword ptr fs:[00000030h] 14_2_04D8766D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAA61C mov eax, dword ptr fs:[00000030h] 14_2_04DAA61C
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAA61C mov eax, dword ptr fs:[00000030h] 14_2_04DAA61C
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7C600 mov eax, dword ptr fs:[00000030h] 14_2_04D7C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7C600 mov eax, dword ptr fs:[00000030h] 14_2_04D7C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7C600 mov eax, dword ptr fs:[00000030h] 14_2_04D7C600
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA8E00 mov eax, dword ptr fs:[00000030h] 14_2_04DA8E00
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E2FE3F mov eax, dword ptr fs:[00000030h] 14_2_04E2FE3F
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E31608 mov eax, dword ptr fs:[00000030h] 14_2_04E31608
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7E620 mov eax, dword ptr fs:[00000030h] 14_2_04D7E620
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB37F5 mov eax, dword ptr fs:[00000030h] 14_2_04DB37F5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF7794 mov eax, dword ptr fs:[00000030h] 14_2_04DF7794
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF7794 mov eax, dword ptr fs:[00000030h] 14_2_04DF7794
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF7794 mov eax, dword ptr fs:[00000030h] 14_2_04DF7794
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D88794 mov eax, dword ptr fs:[00000030h] 14_2_04D88794
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E48F6A mov eax, dword ptr fs:[00000030h] 14_2_04E48F6A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8EF40 mov eax, dword ptr fs:[00000030h] 14_2_04D8EF40
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8FF60 mov eax, dword ptr fs:[00000030h] 14_2_04D8FF60
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9F716 mov eax, dword ptr fs:[00000030h] 14_2_04D9F716
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAA70E mov eax, dword ptr fs:[00000030h] 14_2_04DAA70E
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAA70E mov eax, dword ptr fs:[00000030h] 14_2_04DAA70E
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E4070D mov eax, dword ptr fs:[00000030h] 14_2_04E4070D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E4070D mov eax, dword ptr fs:[00000030h] 14_2_04E4070D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAE730 mov eax, dword ptr fs:[00000030h] 14_2_04DAE730
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0FF10 mov eax, dword ptr fs:[00000030h] 14_2_04E0FF10
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0FF10 mov eax, dword ptr fs:[00000030h] 14_2_04E0FF10
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D74F2E mov eax, dword ptr fs:[00000030h] 14_2_04D74F2E
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D74F2E mov eax, dword ptr fs:[00000030h] 14_2_04D74F2E
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0B8D0 mov eax, dword ptr fs:[00000030h] 14_2_04E0B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0B8D0 mov ecx, dword ptr fs:[00000030h] 14_2_04E0B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0B8D0 mov eax, dword ptr fs:[00000030h] 14_2_04E0B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0B8D0 mov eax, dword ptr fs:[00000030h] 14_2_04E0B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0B8D0 mov eax, dword ptr fs:[00000030h] 14_2_04E0B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E0B8D0 mov eax, dword ptr fs:[00000030h] 14_2_04E0B8D0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D740E1 mov eax, dword ptr fs:[00000030h] 14_2_04D740E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D740E1 mov eax, dword ptr fs:[00000030h] 14_2_04D740E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D740E1 mov eax, dword ptr fs:[00000030h] 14_2_04D740E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D758EC mov eax, dword ptr fs:[00000030h] 14_2_04D758EC
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D79080 mov eax, dword ptr fs:[00000030h] 14_2_04D79080
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF3884 mov eax, dword ptr fs:[00000030h] 14_2_04DF3884
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF3884 mov eax, dword ptr fs:[00000030h] 14_2_04DF3884
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAF0BF mov ecx, dword ptr fs:[00000030h] 14_2_04DAF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAF0BF mov eax, dword ptr fs:[00000030h] 14_2_04DAF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAF0BF mov eax, dword ptr fs:[00000030h] 14_2_04DAF0BF
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB90AF mov eax, dword ptr fs:[00000030h] 14_2_04DB90AF
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA20A0 mov eax, dword ptr fs:[00000030h] 14_2_04DA20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA20A0 mov eax, dword ptr fs:[00000030h] 14_2_04DA20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA20A0 mov eax, dword ptr fs:[00000030h] 14_2_04DA20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA20A0 mov eax, dword ptr fs:[00000030h] 14_2_04DA20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA20A0 mov eax, dword ptr fs:[00000030h] 14_2_04DA20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA20A0 mov eax, dword ptr fs:[00000030h] 14_2_04DA20A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D90050 mov eax, dword ptr fs:[00000030h] 14_2_04D90050
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D90050 mov eax, dword ptr fs:[00000030h] 14_2_04D90050
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E32073 mov eax, dword ptr fs:[00000030h] 14_2_04E32073
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E41074 mov eax, dword ptr fs:[00000030h] 14_2_04E41074
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF7016 mov eax, dword ptr fs:[00000030h] 14_2_04DF7016
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF7016 mov eax, dword ptr fs:[00000030h] 14_2_04DF7016
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF7016 mov eax, dword ptr fs:[00000030h] 14_2_04DF7016
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E44015 mov eax, dword ptr fs:[00000030h] 14_2_04E44015
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E44015 mov eax, dword ptr fs:[00000030h] 14_2_04E44015
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8B02A mov eax, dword ptr fs:[00000030h] 14_2_04D8B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8B02A mov eax, dword ptr fs:[00000030h] 14_2_04D8B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8B02A mov eax, dword ptr fs:[00000030h] 14_2_04D8B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8B02A mov eax, dword ptr fs:[00000030h] 14_2_04D8B02A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA002D mov eax, dword ptr fs:[00000030h] 14_2_04DA002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA002D mov eax, dword ptr fs:[00000030h] 14_2_04DA002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA002D mov eax, dword ptr fs:[00000030h] 14_2_04DA002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA002D mov eax, dword ptr fs:[00000030h] 14_2_04DA002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA002D mov eax, dword ptr fs:[00000030h] 14_2_04DA002D
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E041E8 mov eax, dword ptr fs:[00000030h] 14_2_04E041E8
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7B1E1 mov eax, dword ptr fs:[00000030h] 14_2_04D7B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7B1E1 mov eax, dword ptr fs:[00000030h] 14_2_04D7B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7B1E1 mov eax, dword ptr fs:[00000030h] 14_2_04D7B1E1
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E349A4 mov eax, dword ptr fs:[00000030h] 14_2_04E349A4
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E349A4 mov eax, dword ptr fs:[00000030h] 14_2_04E349A4
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E349A4 mov eax, dword ptr fs:[00000030h] 14_2_04E349A4
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E349A4 mov eax, dword ptr fs:[00000030h] 14_2_04E349A4
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA2990 mov eax, dword ptr fs:[00000030h] 14_2_04DA2990
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9C182 mov eax, dword ptr fs:[00000030h] 14_2_04D9C182
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAA185 mov eax, dword ptr fs:[00000030h] 14_2_04DAA185
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF51BE mov eax, dword ptr fs:[00000030h] 14_2_04DF51BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF51BE mov eax, dword ptr fs:[00000030h] 14_2_04DF51BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF51BE mov eax, dword ptr fs:[00000030h] 14_2_04DF51BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF51BE mov eax, dword ptr fs:[00000030h] 14_2_04DF51BE
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DF69A6 mov eax, dword ptr fs:[00000030h] 14_2_04DF69A6
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA61A0 mov eax, dword ptr fs:[00000030h] 14_2_04DA61A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA61A0 mov eax, dword ptr fs:[00000030h] 14_2_04DA61A0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9B944 mov eax, dword ptr fs:[00000030h] 14_2_04D9B944
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D9B944 mov eax, dword ptr fs:[00000030h] 14_2_04D9B944
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7B171 mov eax, dword ptr fs:[00000030h] 14_2_04D7B171
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7B171 mov eax, dword ptr fs:[00000030h] 14_2_04D7B171
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D7C962 mov eax, dword ptr fs:[00000030h] 14_2_04D7C962
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D79100 mov eax, dword ptr fs:[00000030h] 14_2_04D79100
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D79100 mov eax, dword ptr fs:[00000030h] 14_2_04D79100
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D79100 mov eax, dword ptr fs:[00000030h] 14_2_04D79100
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA513A mov eax, dword ptr fs:[00000030h] 14_2_04DA513A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA513A mov eax, dword ptr fs:[00000030h] 14_2_04DA513A
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D94120 mov eax, dword ptr fs:[00000030h] 14_2_04D94120
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D94120 mov eax, dword ptr fs:[00000030h] 14_2_04D94120
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D94120 mov eax, dword ptr fs:[00000030h] 14_2_04D94120
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D94120 mov eax, dword ptr fs:[00000030h] 14_2_04D94120
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D94120 mov ecx, dword ptr fs:[00000030h] 14_2_04D94120
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA2ACB mov eax, dword ptr fs:[00000030h] 14_2_04DA2ACB
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DA2AE4 mov eax, dword ptr fs:[00000030h] 14_2_04DA2AE4
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAD294 mov eax, dword ptr fs:[00000030h] 14_2_04DAD294
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAD294 mov eax, dword ptr fs:[00000030h] 14_2_04DAD294
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8AAB0 mov eax, dword ptr fs:[00000030h] 14_2_04D8AAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D8AAB0 mov eax, dword ptr fs:[00000030h] 14_2_04D8AAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DAFAB0 mov eax, dword ptr fs:[00000030h] 14_2_04DAFAB0
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D752A5 mov eax, dword ptr fs:[00000030h] 14_2_04D752A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D752A5 mov eax, dword ptr fs:[00000030h] 14_2_04D752A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D752A5 mov eax, dword ptr fs:[00000030h] 14_2_04D752A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D752A5 mov eax, dword ptr fs:[00000030h] 14_2_04D752A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D752A5 mov eax, dword ptr fs:[00000030h] 14_2_04D752A5
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E2B260 mov eax, dword ptr fs:[00000030h] 14_2_04E2B260
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E2B260 mov eax, dword ptr fs:[00000030h] 14_2_04E2B260
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04E48A62 mov eax, dword ptr fs:[00000030h] 14_2_04E48A62
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D79240 mov eax, dword ptr fs:[00000030h] 14_2_04D79240
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D79240 mov eax, dword ptr fs:[00000030h] 14_2_04D79240
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D79240 mov eax, dword ptr fs:[00000030h] 14_2_04D79240
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04D79240 mov eax, dword ptr fs:[00000030h] 14_2_04D79240
Source: C:\Windows\SysWOW64\systray.exe Code function: 14_2_04DB927A mov eax, dword ptr fs:[00000030h] 14_2_04DB927A
Checks if the current process is being debugged
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Process queried: DebugPort Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process queried: DebugPort Jump to behavior
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Code function: 2_2_0040ACF0 LdrLoadDll, 2_2_0040ACF0

HIPS / PFW / Operating System Protection Evasion
barindex
System process connects to network (likely due to code injection or exploit)
Source: C:\Windows\explorer.exe Domain query: www.fortitude-tech.com
Sample uses process hollowing technique
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Section unmapped: C:\Windows\SysWOW64\systray.exe base address: D70000 Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Section loaded: unknown target: C:\Windows\SysWOW64\systray.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: C:\Windows\explorer.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Section loaded: unknown target: unknown protection: read write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Thread APC queued: target process: C:\Windows\explorer.exe Jump to behavior
Modifies the context of a thread in another process (thread injection)
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Thread register set: target process: 684 Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Thread register set: target process: 684 Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Thread register set: target process: 684 Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\AppData\Local\Temp\rysgtozci.exe Process created: C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\rysgtozci.exe C:\Users\user\AppData\Local\Temp\wduqqtzg Jump to behavior
Source: C:\Windows\SysWOW64\systray.exe Process created: C:\Windows\SysWOW64\cmd.exe /c del "C:\Users\user\AppData\Local\Temp\rysgtozci.exe" Jump to behavior
Source: explorer.exe, 00000003.00000000.468227279.0000000007EF6000.00000004.00000001.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.497096439.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.482680160.0000000006100000.00000004.00000001.00020000.00000000.sdmp Binary or memory string: Shell_TrayWnd
Source: explorer.exe, 00000003.00000000.535949513.0000000000E38000.00000004.00000020.00020000.00000000.sdmp, explorer.exe, 00000003.00000000.497096439.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.449192547.0000000001430000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progman
Source: explorer.exe, 00000003.00000000.497096439.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.449192547.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.478366360.0000000001430000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: YProgram Managerf
Source: explorer.exe, 00000003.00000000.497096439.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.449192547.0000000001430000.00000002.00000001.00040000.00000000.sdmp, explorer.exe, 00000003.00000000.478366360.0000000001430000.00000002.00000001.00040000.00000000.sdmp Binary or memory string: Progmanlock
Source: C:\Users\user\Desktop\Ay9xkK3NYN.exe Code function: 0_2_004034F7 EntryPoint,SetErrorMode,GetVersionExW,GetVersionExW,GetVersionExW,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,CopyFileW,CloseHandle,ExitProcess,OleUninitialize,ExitProcess,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004034F7

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 2.0.rysgtozci.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rysgtozci.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.rysgtozci.exe.600000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.rysgtozci.exe.600000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rysgtozci.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.696256426.00000000048E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.553285992.00000000005B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.694897544.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.441965873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.491644734.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.695692167.00000000048B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.440397426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.552642858.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.516553688.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.445776431.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 2.0.rysgtozci.exe.400000.6.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rysgtozci.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.5.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.6.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.rysgtozci.exe.600000.1.raw.unpack, type: UNPACKEDPE
Source: Yara match File source: 1.2.rysgtozci.exe.600000.1.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.5.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.0.rysgtozci.exe.400000.4.unpack, type: UNPACKEDPE
Source: Yara match File source: 2.2.rysgtozci.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match File source: 00000002.00000002.553583563.00000000005E0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.696256426.00000000048E0000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.553285992.00000000005B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.694897544.0000000000C80000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.441965873.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.491644734.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 0000000E.00000002.695692167.00000000048B0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000000.440397426.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000002.00000002.552642858.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000000.516553688.000000000F6CB000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.445776431.0000000000600000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 signatures2 2 Behavior Graph ID: 620775 Sample: Ay9xkK3NYN Startdate: 05/05/2022 Architecture: WINDOWS Score: 100 43 Found malware configuration 2->43 45 Malicious sample detected (through community Yara rule) 2->45 47 Multi AV Scanner detection for submitted file 2->47 49 4 other signatures 2->49 11 Ay9xkK3NYN.exe 18 2->11         started        process3 file4 31 C:\Users\user\AppData\Local\...\rysgtozci.exe, PE32 11->31 dropped 14 rysgtozci.exe 11->14         started        process5 signatures6 59 Tries to detect virtualization through RDTSC time measurements 14->59 17 rysgtozci.exe 14->17         started        process7 signatures8 35 Modifies the context of a thread in another process (thread injection) 17->35 37 Maps a DLL or memory area into another process 17->37 39 Sample uses process hollowing technique 17->39 41 Queues an APC in another process (thread injection) 17->41 20 explorer.exe 17->20 injected process9 dnsIp10 33 www.fortitude-tech.com 20->33 51 System process connects to network (likely due to code injection or exploit) 20->51 24 systray.exe 20->24         started        signatures11 process12 signatures13 53 Modifies the context of a thread in another process (thread injection) 24->53 55 Maps a DLL or memory area into another process 24->55 57 Tries to detect virtualization through RDTSC time measurements 24->57 27 cmd.exe 1 24->27         started        process14 process15 29 conhost.exe 27->29         started       
⊘No contacted IP infos

Contacted Domains

Name IP Active
www.fortitude-tech.com unknown unknown

Contacted URLs

Name Malicious Antivirus Detection Reputation
www.shishlomarket24.biz/fw02/ true
  • 0%, Virustotal, Browse
  • Avira URL Cloud: safe
 low