Windows Analysis Report
a.exe

Overview

General Information

Sample name: a.exe
Analysis ID: 1435820
MD5: edffe40059fc3fc1a74deac16c149714
SHA1: 8dacb5f08546798e456e652967a34c137c1d0b91
SHA256: ff1e39d25a85d03b52ade37a8cc63506171216099bf74d03c1729115f620a4f2
Infos:

Detection

FormBook, GuLoader
Score: 100
Range: 0 - 100
Whitelisted: false
Confidence: 100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected FormBook
Yara detected GuLoader
Found direct / indirect Syscall (likely to bypass EDR)
Maps a DLL or memory area into another process
Queues an APC in another process (thread injection)
Checks if the current process is being debugged
Contains functionality for execution timing, often used to detect debuggers
Contains functionality for read data from the clipboard
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains functionality to call native functions
Contains functionality to dynamically determine API calls
Contains functionality to read the PEB
Contains functionality to shutdown / reboot the system
Creates a process in suspended mode (likely to inject code)
Creates files inside the system directory
Detected potential crypto function
Drops PE files
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found dropped PE file which has not been started or loaded
Found inlined nop instructions (likely shell or obfuscated code)
Found large amount of non-executed APIs
Found potential string decryption / allocating functions
JA3 SSL client fingerprint seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
PE / OLE file has an invalid certificate
Sample execution stops while process was sleeping (likely an evasion)
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses a known web browser user agent for HTTP communication
Uses code obfuscation techniques (call, push, ret)
Yara signature match

Classification

AV Detection
barindex
Multi AV Scanner detection for domain / URL
Source: www.benappetit.co.uk Virustotal: Detection: 6% Perma Link
Multi AV Scanner detection for submitted file
Source: a.exe Virustotal: Detection: 28% Perma Link
Source: a.exe ReversingLabs: Detection: 13%
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.4099056387.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4098989779.0000000000D90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2698538356.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2723097788.0000000036270000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4099145060.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4098489075.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4100016016.0000000003A90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
Uses 32bit PE files
Source: a.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Source: unknown HTTPS traffic detected: 142.250.31.102:443 -> 192.168.11.20:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.253.122.132:443 -> 192.168.11.20:49793 version: TLS 1.2
Source: a.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wevtutil.pdbGCTL source: a.exe, 00000001.00000003.2667556155.00000000351C1000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2667749166.00000000351F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdb source: a.exe, 00000001.00000001.2475314007.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source: Binary string: wntdll.pdbUGP source: a.exe, 00000001.00000003.2616756828.00000000351C6000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2722157155.000000003564D000.00000040.00001000.00020000.00000000.sdmp, a.exe, 00000001.00000003.2619882793.0000000035372000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2722157155.0000000035520000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: a.exe, a.exe, 00000001.00000003.2616756828.00000000351C6000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2722157155.000000003564D000.00000040.00001000.00020000.00000000.sdmp, a.exe, 00000001.00000003.2619882793.0000000035372000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2722157155.0000000035520000.00000040.00001000.00020000.00000000.sdmp, wevtutil.exe
Source: Binary string: wevtutil.pdb source: a.exe, 00000001.00000003.2667556155.00000000351C1000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2667749166.00000000351F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdbUGP source: a.exe, 00000001.00000001.2475314007.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_0040596F
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_004064C1 FindFirstFileW,FindClose, 0_2_004064C1
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_004027FB FindFirstFileW, 0_2_004027FB
Found inlined nop instructions (likely shell or obfuscated code)
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4x nop then pop edi 4_2_003D2260
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4x nop then xor eax, eax 4_2_003CA320
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4x nop then pop edi 4_2_003CEA1B

Networking
barindex
Snort IDS alert for network traffic
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49794 -> 213.171.195.105:80
Source: Traffic Snort IDS: 2855465 ETPRO TROJAN FormBook CnC Checkin (GET) M2 192.168.11.20:49798 -> 64.190.62.22:80
JA3 SSL client fingerprint seen in connection with other malware
Source: Joe Sandbox View JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19
Uses a known web browser user agent for HTTP communication
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsm&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: global traffic HTTP traffic detected: GET /uc?export=download&id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsm HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Host: drive.google.comCache-Control: no-cache
Source: global traffic HTTP traffic detected: GET /download?id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsm&export=download HTTP/1.1User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:121.0) Gecko/20100101 Firefox/121.0Cache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic DNS traffic detected: DNS query: drive.google.com
Source: global traffic DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic DNS traffic detected: DNS query: www.benappetit.co.uk
Source: global traffic DNS traffic detected: DNS query: www.nurse-job2535.life
Source: a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2617578776.000000000527E000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712105100.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.comodoca.com/AAACertificateServices.crl06
Source: a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2617578776.000000000527E000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712105100.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://crl.globalsign.net/root-r2.crl0
Source: a.exe, 00000001.00000001.2475314007.0000000000649000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://inference.location.live.com11111111-1111-1111-1111-111111111111https://partnernext-inference.
Source: a.exe, 00000000.00000002.2580587822.000000000040A000.00000004.00000001.01000000.00000003.sdmp, a.exe, 00000000.00000000.2247046971.000000000040A000.00000008.00000001.01000000.00000003.sdmp, a.exe, 00000001.00000000.2473275431.000000000040A000.00000008.00000001.01000000.00000003.sdmp String found in binary or memory: http://nsis.sf.net/NSIS_ErrorError
Source: a.exe, 00000001.00000001.2475314007.0000000000649000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: http://www.gopher.ftp://ftp.
Source: a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2617578776.000000000527E000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712105100.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: http://www.quovadis.bm0
Source: a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://apis.google.com
Source: a.exe, 00000001.00000002.2711750941.00000000051F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/
Source: a.exe, 00000001.00000002.2711750941.00000000051F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/;
Source: a.exe, 00000001.00000002.2711750941.00000000051F8000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712541212.0000000005440000.00000004.00001000.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711750941.000000000523A000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsm
Source: a.exe, 00000001.00000002.2711750941.00000000051F8000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.google.com/uc?export=download&id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsmD
Source: a.exe, 00000001.00000003.2617578776.000000000527E000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711750941.000000000525C000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712105100.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/
Source: a.exe, 00000001.00000003.2617656052.0000000005266000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2617578776.000000000527E000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711990491.0000000005266000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712105100.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsm&export=download
Source: a.exe, 00000001.00000003.2617656052.0000000005266000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711990491.0000000005266000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsm&export=download#
Source: a.exe, 00000001.00000003.2617578776.000000000527E000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712105100.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/download?id=1SHUOSDlKVfBWQ-JCVtUS2cxwDXP5bGsm&export=downloadty
Source: a.exe, 00000001.00000003.2617578776.000000000527E000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712105100.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://drive.usercontent.google.com/p
Source: a.exe, 00000001.00000001.2475314007.0000000000649000.00000020.00000001.01000000.00000007.sdmp String found in binary or memory: https://inference.location.live.net/inferenceservice/v21/Pox/GetLocationUsingFingerprinte1e71f6b-214
Source: a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2617578776.000000000527E000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2712105100.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ocsp.quovadisoffshore.com0
Source: a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://ssl.gstatic.com
Source: a.exe, 00000001.00000003.2617656052.0000000005266000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711990491.0000000005266000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google-analytics.com;report-uri
Source: a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.google.com
Source: a.exe, 00000001.00000003.2617656052.0000000005266000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711990491.0000000005266000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.googletagmanager.com
Source: a.exe, 00000001.00000003.2617656052.0000000005266000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2565751189.0000000005281000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711990491.0000000005266000.00000004.00000020.00020000.00000000.sdmp String found in binary or memory: https://www.gstatic.com
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown HTTPS traffic detected: 142.250.31.102:443 -> 192.168.11.20:49792 version: TLS 1.2
Source: unknown HTTPS traffic detected: 172.253.122.132:443 -> 192.168.11.20:49793 version: TLS 1.2
Contains functionality for read data from the clipboard
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_0040541C GetDlgItem,GetDlgItem,GetDlgItem,GetDlgItem,GetClientRect,GetSystemMetrics,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ShowWindow,ShowWindow,GetDlgItem,SendMessageW,SendMessageW,SendMessageW,GetDlgItem,CreateThread,CloseHandle,ShowWindow,ShowWindow,ShowWindow,ShowWindow,LdrInitializeThunk,SendMessageW,CreatePopupMenu,LdrInitializeThunk,AppendMenuW,GetWindowRect,TrackPopupMenu,SendMessageW,OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,SendMessageW,GlobalUnlock,SetClipboardData,CloseClipboard, 0_2_0040541C

E-Banking Fraud
barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.4099056387.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4098989779.0000000000D90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2698538356.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2723097788.0000000036270000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4099145060.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4098489075.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4100016016.0000000003A90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

System Summary
barindex
Malicious sample detected (through community Yara rule)
Source: 00000004.00000002.4099056387.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000005.00000002.4098989779.0000000000D90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2698538356.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000001.00000002.2723097788.0000000036270000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4099145060.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000004.00000002.4098489075.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Source: 00000003.00000002.4100016016.0000000003A90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 Author: unknown
Contains functionality to call native functions
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355934E0 NtCreateMutant,LdrInitializeThunk, 1_2_355934E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592B90 NtFreeVirtualMemory,LdrInitializeThunk, 1_2_35592B90
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35593C30 NtOpenProcessToken, 1_2_35593C30
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35593C90 NtOpenThread, 1_2_35593C90
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355938D0 NtGetContextThread, 1_2_355938D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35594570 NtSuspendThread, 1_2_35594570
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35594260 NtSetContextThread, 1_2_35594260
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592D50 NtWriteVirtualMemory, 1_2_35592D50
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592D10 NtQuerySystemInformation, 1_2_35592D10
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592DC0 NtAdjustPrivilegesToken, 1_2_35592DC0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592DA0 NtReadVirtualMemory, 1_2_35592DA0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592C50 NtUnmapViewOfSection, 1_2_35592C50
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592C10 NtOpenProcess, 1_2_35592C10
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592C30 NtMapViewOfSection, 1_2_35592C30
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592C20 NtSetInformationFile, 1_2_35592C20
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592CD0 NtEnumerateKey, 1_2_35592CD0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592CF0 NtDelayExecution, 1_2_35592CF0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592F00 NtCreateFile, 1_2_35592F00
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592F30 NtOpenDirectoryObject, 1_2_35592F30
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592FB0 NtSetValueKey, 1_2_35592FB0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592E50 NtCreateSection, 1_2_35592E50
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592E00 NtQueueApcThread, 1_2_35592E00
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592ED0 NtResumeThread, 1_2_35592ED0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592EC0 NtQuerySection, 1_2_35592EC0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592E80 NtCreateProcessEx, 1_2_35592E80
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35592EB0 NtProtectVirtualMemory, 1_2_35592EB0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355929D0 NtWaitForSingleObject, 1_2_355929D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355929F0 NtReadFile, 1_2_355929F0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD4260 NtSetContextThread,LdrInitializeThunk, 4_2_02FD4260
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD34E0 NtCreateMutant,LdrInitializeThunk, 4_2_02FD34E0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD4570 NtSuspendThread,LdrInitializeThunk, 4_2_02FD4570
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2A80 NtClose,LdrInitializeThunk, 4_2_02FD2A80
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2BC0 NtQueryInformationToken,LdrInitializeThunk, 4_2_02FD2BC0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2B90 NtFreeVirtualMemory,LdrInitializeThunk, 4_2_02FD2B90
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2B80 NtCreateKey,LdrInitializeThunk, 4_2_02FD2B80
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2B10 NtAllocateVirtualMemory,LdrInitializeThunk, 4_2_02FD2B10
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2B00 NtQueryValueKey,LdrInitializeThunk, 4_2_02FD2B00
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD38D0 NtGetContextThread,LdrInitializeThunk, 4_2_02FD38D0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD29F0 NtReadFile,LdrInitializeThunk, 4_2_02FD29F0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2ED0 NtResumeThread,LdrInitializeThunk, 4_2_02FD2ED0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2E50 NtCreateSection,LdrInitializeThunk, 4_2_02FD2E50
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2E00 NtQueueApcThread,LdrInitializeThunk, 4_2_02FD2E00
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2F00 NtCreateFile,LdrInitializeThunk, 4_2_02FD2F00
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2CF0 NtDelayExecution,LdrInitializeThunk, 4_2_02FD2CF0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2C50 NtUnmapViewOfSection,LdrInitializeThunk, 4_2_02FD2C50
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2C30 NtMapViewOfSection,LdrInitializeThunk, 4_2_02FD2C30
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2DA0 NtReadVirtualMemory,LdrInitializeThunk, 4_2_02FD2DA0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2D10 NtQuerySystemInformation,LdrInitializeThunk, 4_2_02FD2D10
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2AC0 NtEnumerateValueKey, 4_2_02FD2AC0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2AA0 NtQueryInformationFile, 4_2_02FD2AA0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2A10 NtWriteFile, 4_2_02FD2A10
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2BE0 NtQueryVirtualMemory, 4_2_02FD2BE0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2B20 NtQueryInformationProcess, 4_2_02FD2B20
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD29D0 NtWaitForSingleObject, 4_2_02FD29D0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2EC0 NtQuerySection, 4_2_02FD2EC0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2EB0 NtProtectVirtualMemory, 4_2_02FD2EB0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2E80 NtCreateProcessEx, 4_2_02FD2E80
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2FB0 NtSetValueKey, 4_2_02FD2FB0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2F30 NtOpenDirectoryObject, 4_2_02FD2F30
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2CD0 NtEnumerateKey, 4_2_02FD2CD0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD3C90 NtOpenThread, 4_2_02FD3C90
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD3C30 NtOpenProcessToken, 4_2_02FD3C30
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2C20 NtSetInformationFile, 4_2_02FD2C20
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2C10 NtOpenProcess, 4_2_02FD2C10
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2DC0 NtAdjustPrivilegesToken, 4_2_02FD2DC0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FD2D50 NtWriteVirtualMemory, 4_2_02FD2D50
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003E6360 NtCreateFile, 4_2_003E6360
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003E6490 NtReadFile, 4_2_003E6490
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003E6550 NtDeleteFile, 4_2_003E6550
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003E65D0 NtClose, 4_2_003E65D0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003E6700 NtAllocateVirtualMemory, 4_2_003E6700
Contains functionality to shutdown / reboot the system
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004033B6
Creates files inside the system directory
Source: C:\Users\user\Desktop\a.exe File created: C:\Windows\resources\0409 Jump to behavior
Detected potential crypto function
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_00406846 0_2_00406846
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_00404C59 0_2_00404C59
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355A5550 1_2_355A5550
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356175C6 1_2_356175C6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561F5C9 1_2_3561F5C9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F5490 1_2_355F5490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CD480 1_2_355CD480
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555170C 1_2_3555170C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556B650 1_2_3556B650
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560D646 1_2_3560D646
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35601623 1_2_35601623
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FD62C 1_2_355FD62C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561F6F6 1_2_3561F6F6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D36EC 1_2_355D36EC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355A717A 1_2_355A717A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FD130 1_2_355FD130
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355651C0 1_2_355651C0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556B0D0 1_2_3556B0D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356170F1 1_2_356170F1
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3559508C 1_2_3559508C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561F330 1_2_3561F330
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551380 1_2_35551380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561124C 1_2_3561124C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557D210 1_2_3557D210
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554D2EC 1_2_3554D2EC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35617D4C 1_2_35617D4C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35521D7D 1_2_35521D7D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35613D22 1_2_35613D22
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561FD27 1_2_3561FD27
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35621D2E 1_2_35621D2E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35569DD0 1_2_35569DD0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E7CE8 1_2_355E7CE8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561FF63 1_2_3561FF63
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DFF40 1_2_355DFF40
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35603FA0 1_2_35603FA0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35619ED2 1_2_35619ED2
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35561EB2 1_2_35561EB2
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355A59C0 1_2_355A59C0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355299E8 1_2_355299E8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561F872 1_2_3561F872
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557B870 1_2_3557B870
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D5870 1_2_355D5870
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35563800 1_2_35563800
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356178F3 1_2_356178F3
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356118DA 1_2_356118DA
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35579B40 1_2_35579B40
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3559DB19 1_2_3559DB19
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561FB2E 1_2_3561FB2E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F1B80 1_2_355F1B80
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561FA89 1_2_3561FA89
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35560445 1_2_35560445
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35616757 1_2_35616757
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556A760 1_2_3556A760
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35562760 1_2_35562760
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561E709 1_2_3561E709
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35584670 1_2_35584670
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557C600 1_2_3557C600
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561A6C0 1_2_3561A6C0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555C6E0 1_2_3555C6E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35560680 1_2_35560680
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562010E 1_2_3562010E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355500A0 1_2_355500A0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556E310 1_2_3556E310
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35522245 1_2_35522245
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35560D69 1_2_35560D69
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35572DB0 1_2_35572DB0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561EC60 1_2_3561EC60
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35616C69 1_2_35616C69
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560EC4C 1_2_3560EC4C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35550C12 1_2_35550C12
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556AC20 1_2_3556AC20
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DEC20 1_2_355DEC20
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35578CDF 1_2_35578CDF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556CF00 1_2_3556CF00
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561EFBF 1_2_3561EFBF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35580E50 1_2_35580E50
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35600E6D 1_2_35600E6D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355A2E48 1_2_355A2E48
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35552EE8 1_2_35552EE8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35610EAD 1_2_35610EAD
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03A9C0B3 3_2_03A9C0B3
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03A9E033 3_2_03A9E033
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03A9DE13 3_2_03A9DE13
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03AA45A3 3_2_03AA45A3
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03AB9503 3_2_03AB9503
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F8D2EC 4_2_02F8D2EC
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305F330 4_2_0305F330
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F62245 4_2_02F62245
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F91380 4_2_02F91380
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FAE310 4_2_02FAE310
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0306010E 4_2_0306010E
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FAB0D0 4_2_02FAB0D0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F900A0 4_2_02F900A0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FBB1E0 4_2_02FBB1E0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA51C0 4_2_02FA51C0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0304E076 4_2_0304E076
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FE717A 4_2_02FE717A
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F8F113 4_2_02F8F113
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_030570F1 4_2_030570F1
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F9C6E0 4_2_02F9C6E0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_03056757 4_2_03056757
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA0680 4_2_02FA0680
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FC4670 4_2_02FC4670
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FBC600 4_2_02FBC600
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0303D62C 4_2_0303D62C
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0304D646 4_2_0304D646
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA2760 4_2_02FA2760
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FAA760 4_2_02FAA760
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305A6C0 4_2_0305A6C0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F61707 4_2_02F61707
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305F6F6 4_2_0305F6F6
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F9170C 4_2_02F9170C
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0306A526 4_2_0306A526
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA0445 4_2_02FA0445
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_030575C6 4_2_030575C6
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305F5C9 4_2_0305F5C9
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305FB2E 4_2_0305FB2E
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FBFAA0 4_2_02FBFAA0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_03014BC0 4_2_03014BC0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305CA13 4_2_0305CA13
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305EA5B 4_2_0305EA5B
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305FA89 4_2_0305FA89
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA0B10 4_2_02FA0B10
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FB6882 4_2_02FB6882
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA9870 4_2_02FA9870
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FBB870 4_2_02FBB870
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F86868 4_2_02F86868
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305E9A6 4_2_0305E9A6
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA3800 4_2_02FA3800
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F699E8 4_2_02F699E8
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_03040835 4_2_03040835
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F9E9A0 4_2_02F9E9A0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305F872 4_2_0305F872
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_030578F3 4_2_030578F3
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F92EE8 4_2_02F92EE8
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA1EB2 4_2_02FA1EB2
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305FF63 4_2_0305FF63
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FC0E50 4_2_02FC0E50
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305EFBF 4_2_0305EFBF
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA6FE0 4_2_02FA6FE0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_03040E6D 4_2_03040E6D
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_03050EAD 4_2_03050EAD
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_03059ED2 4_2_03059ED2
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FACF00 4_2_02FACF00
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FBFCE0 4_2_02FBFCE0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305FD27 4_2_0305FD27
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FB8CDF 4_2_02FB8CDF
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_03057D4C 4_2_03057D4C
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA3C60 4_2_02FA3C60
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FAAC20 4_2_02FAAC20
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F90C12 4_2_02F90C12
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0303FDF4 4_2_0303FDF4
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA9DD0 4_2_02FA9DD0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0304EC4C 4_2_0304EC4C
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FB2DB0 4_2_02FB2DB0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0305EC60 4_2_0305EC60
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_03056C69 4_2_03056C69
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02FA0D69 4_2_02FA0D69
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_0306ACEB 4_2_0306ACEB
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F9AD00 4_2_02F9AD00
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003D2260 4_2_003D2260
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003CD250 4_2_003CD250
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003CD470 4_2_003CD470
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003CB4F0 4_2_003CB4F0
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003E8940 4_2_003E8940
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003D39E0 4_2_003D39E0
Found potential string decryption / allocating functions
Source: C:\Users\user\Desktop\a.exe Code function: String function: 355CE692 appears 64 times
Source: C:\Users\user\Desktop\a.exe Code function: String function: 355DEF10 appears 83 times
Source: C:\Users\user\Desktop\a.exe Code function: String function: 3554B910 appears 205 times
Source: C:\Users\user\Desktop\a.exe Code function: String function: 35595050 appears 50 times
Source: C:\Users\user\Desktop\a.exe Code function: String function: 355A7BE4 appears 88 times
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: String function: 0301EF10 appears 96 times
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: String function: 02F8B910 appears 244 times
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: String function: 02FD5050 appears 34 times
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: String function: 0300E692 appears 72 times
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: String function: 02FE7BE4 appears 76 times
PE / OLE file has an invalid certificate
Source: a.exe Static PE information: invalid certificate
Sample file is different than original file name gathered from version info
Source: a.exe, 00000000.00000002.2580963399.0000000000455000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameinanity.exe4 vs a.exe
Source: a.exe, 00000001.00000003.2619882793.000000003549F000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs a.exe
Source: a.exe, 00000001.00000002.2722157155.000000003564D000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs a.exe
Source: a.exe, 00000001.00000003.2616756828.00000000352E9000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs a.exe
Source: a.exe, 00000001.00000003.2667556155.00000000351C1000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewevtutil.exej% vs a.exe
Source: a.exe, 00000001.00000003.2667749166.00000000351F5000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: OriginalFilenamewevtutil.exej% vs a.exe
Source: a.exe, 00000001.00000002.2722157155.00000000357F0000.00000040.00001000.00020000.00000000.sdmp Binary or memory string: OriginalFilenamentdll.dllj% vs a.exe
Source: a.exe, 00000001.00000000.2473322763.0000000000455000.00000002.00000001.01000000.00000003.sdmp Binary or memory string: OriginalFilenameinanity.exe4 vs a.exe
Uses 32bit PE files
Source: a.exe Static PE information: RELOCS_STRIPPED, EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, 32BIT_MACHINE
Yara signature match
Source: 00000004.00000002.4099056387.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000005.00000002.4098989779.0000000000D90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2698538356.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000001.00000002.2723097788.0000000036270000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4099145060.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000004.00000002.4098489075.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: 00000003.00000002.4100016016.0000000003A90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY Matched rule: Windows_Trojan_Formbook_1112e116 reference_sample = 6246f3b89f0e4913abd88ae535ae3597865270f58201dc7f8ec0c87f15ff370a, os = windows, severity = x86, creation_date = 2021-06-14, scan_context = file, memory, license = Elastic License v2, threat_name = Windows.Trojan.Formbook, fingerprint = b8b88451ad8c66b54e21455d835a5d435e52173c86e9b813ffab09451aff7134, id = 1112e116-dee0-4818-a41f-ca5c1c41b4b8, last_modified = 2021-08-23
Source: classification engine Classification label: mal100.troj.evad.winEXE@5/10@4/2
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_004033B6 EntryPoint,SetErrorMode,GetVersion,lstrlenA,#17,OleInitialize,SHGetFileInfoW,GetCommandLineW,GetModuleHandleW,CharNextW,GetTempPathW,GetTempPathW,GetWindowsDirectoryW,lstrcatW,GetTempPathW,lstrcatW,SetEnvironmentVariableW,SetEnvironmentVariableW,SetEnvironmentVariableW,DeleteFileW,OleUninitialize,ExitProcess,lstrcatW,lstrcatW,lstrcatW,lstrcmpiW,SetCurrentDirectoryW,DeleteFileW,LdrInitializeThunk,CopyFileW,CloseHandle,GetCurrentProcess,OpenProcessToken,LookupPrivilegeValueW,AdjustTokenPrivileges,ExitWindowsEx,ExitProcess, 0_2_004033B6
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_004046DD GetDlgItem,SetWindowTextW,LdrInitializeThunk,LdrInitializeThunk,SHBrowseForFolderW,CoTaskMemFree,lstrcmpiW,lstrcatW,SetDlgItemTextW,LdrInitializeThunk,GetDiskFreeSpaceW,MulDiv,SetDlgItemTextW, 0_2_004046DD
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_00402095 LdrInitializeThunk,CoCreateInstance,LdrInitializeThunk, 0_2_00402095
Source: C:\Users\user\Desktop\a.exe File created: C:\Users\user\tndingers Jump to behavior
Source: C:\Users\user\Desktop\a.exe File created: C:\Users\user\AppData\Local\Temp\nse33B6.tmp Jump to behavior
Source: a.exe Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
Source: C:\Users\user\Desktop\a.exe File read: C:\Users\desktop.ini Jump to behavior
Source: C:\Users\user\Desktop\a.exe Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers Jump to behavior
Source: a.exe Virustotal: Detection: 28%
Source: a.exe ReversingLabs: Detection: 13%
Source: C:\Users\user\Desktop\a.exe File read: C:\Users\user\Desktop\a.exe Jump to behavior
Source: unknown Process created: C:\Users\user\Desktop\a.exe "C:\Users\user\Desktop\a.exe"
Source: C:\Users\user\Desktop\a.exe Process created: C:\Users\user\Desktop\a.exe "C:\Users\user\Desktop\a.exe"
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "C:\Windows\SysWOW64\wevtutil.exe"
Source: C:\Users\user\Desktop\a.exe Process created: C:\Users\user\Desktop\a.exe "C:\Users\user\Desktop\a.exe" Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "C:\Windows\SysWOW64\wevtutil.exe" Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: uxtheme.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: userenv.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: apphelp.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: propsys.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: dwmapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: oleacc.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: version.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: shfolder.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: riched20.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: usp10.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: msls31.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: textinputframework.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: coreuicomponents.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: coremessaging.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: ntmarta.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: wintypes.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: textshaping.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: iertutil.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: sspicli.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: powrprof.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: winhttp.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: wkscli.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: netutils.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: umpdc.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: windows.storage.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: wldp.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: profapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: kernel.appcore.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: ondemandconnroutehelper.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: mswsock.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: iphlpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: winnsi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: urlmon.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: srvcli.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: dnsapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: rasadhlp.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: fwpuclnt.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: schannel.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: mskeyprotect.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: ntasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: msasn1.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: dpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: cryptsp.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: rsaenh.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: cryptbase.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: gpapi.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: ncrypt.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: ncryptsslp.dll Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe Section loaded: edgegdi.dll Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Section loaded: wininet.dll Jump to behavior
Source: C:\Users\user\Desktop\a.exe Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f486a52-3cb1-48fd-8f50-b8dc300d9f9d}\InProcServer32 Jump to behavior
Source: C:\Users\user\Desktop\a.exe File written: C:\Users\user\Forbydende173.ini Jump to behavior
Source: a.exe Static PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
Source: Binary string: wevtutil.pdbGCTL source: a.exe, 00000001.00000003.2667556155.00000000351C1000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2667749166.00000000351F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdb source: a.exe, 00000001.00000001.2475314007.0000000000649000.00000020.00000001.01000000.00000007.sdmp
Source: Binary string: wntdll.pdbUGP source: a.exe, 00000001.00000003.2616756828.00000000351C6000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2722157155.000000003564D000.00000040.00001000.00020000.00000000.sdmp, a.exe, 00000001.00000003.2619882793.0000000035372000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2722157155.0000000035520000.00000040.00001000.00020000.00000000.sdmp
Source: Binary string: wntdll.pdb source: a.exe, a.exe, 00000001.00000003.2616756828.00000000351C6000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2722157155.000000003564D000.00000040.00001000.00020000.00000000.sdmp, a.exe, 00000001.00000003.2619882793.0000000035372000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2722157155.0000000035520000.00000040.00001000.00020000.00000000.sdmp, wevtutil.exe
Source: Binary string: wevtutil.pdb source: a.exe, 00000001.00000003.2667556155.00000000351C1000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000003.2667749166.00000000351F5000.00000004.00000020.00020000.00000000.sdmp
Source: Binary string: mshtml.pdbUGP source: a.exe, 00000001.00000001.2475314007.0000000000649000.00000020.00000001.01000000.00000007.sdmp

Data Obfuscation
barindex
Yara detected GuLoader
Source: Yara match File source: 00000000.00000002.2582825548.000000000595A000.00000040.00001000.00020000.00000000.sdmp, type: MEMORY
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_10001B18
Uses code obfuscation techniques (call, push, ret)
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_10002DE0 push eax; ret 0_2_10002E0E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355297A1 push es; iretd 1_2_355297A8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355221AD pushad ; retf 0004h 1_2_3552223F
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03AA037F pushad ; ret 3_2_03AA0381
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03AA91E6 push ss; ret 3_2_03AA91E7
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03A9C0AC push es; retf 3_2_03A9C0B2
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03A9B00E push ebx; iretd 3_2_03A9B032
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03AA1047 pushad ; ret 3_2_03AA1048
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03A9B053 push D835DCE2h; iretd 3_2_03A9B05A
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03AA7FFF pushfd ; iretd 3_2_03AA801D
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03A9E6FA push ecx; ret 3_2_03A9E6FB
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03A9E6DD pushfd ; retf 3_2_03A9E6DE
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Code function: 3_2_03ABA5A2 push eax; ret 3_2_03ABA5A4
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F6E074 pushfd ; retf 4_2_02F6E075
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F6E060 push eax; retf 0008h 4_2_02F6E06D
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F621AD pushad ; retf 0004h 4_2_02F6223F
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F697A1 push es; iretd 4_2_02F697A8
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_02F908CD push ecx; mov dword ptr [esp], ecx 4_2_02F908D6
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003D743C pushfd ; iretd 4_2_003D745A
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003D0484 pushad ; ret 4_2_003D0485
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003CB4E9 push es; retf 4_2_003CB4EF
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003D8623 push ss; ret 4_2_003D8624
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003CF7BC pushad ; ret 4_2_003CF7BE
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003E08F6 push 702EB190h; iretd 4_2_003E0909
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003E99DF push eax; ret 4_2_003E99E1
Source: C:\Windows\SysWOW64\wevtutil.exe Code function: 4_2_003CDB1A pushfd ; retf 4_2_003CDB1B
Drops PE files
Source: C:\Users\user\Desktop\a.exe File created: C:\Users\user\AppData\Local\Temp\nsf36C6.tmp\System.dll Jump to dropped file
Source: C:\Users\user\Desktop\a.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Users\user\Desktop\a.exe Process information set: NOOPENFILEERRORBOX Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe Process information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591763 rdtsc 1_2_35591763
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Source: C:\Windows\SysWOW64\wevtutil.exe Window / User API: threadDelayed 9229 Jump to behavior
Found dropped PE file which has not been started or loaded
Source: C:\Users\user\Desktop\a.exe Dropped PE file which has not been started: C:\Users\user\AppData\Local\Temp\nsf36C6.tmp\System.dll Jump to dropped file
Found large amount of non-executed APIs
Source: C:\Users\user\Desktop\a.exe API coverage: 0.1 %
Source: C:\Windows\SysWOW64\wevtutil.exe API coverage: 2.7 %
May sleep (evasive loops) to hinder dynamic analysis
Source: C:\Windows\SysWOW64\wevtutil.exe TID: 7152 Thread sleep count: 121 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe TID: 7152 Thread sleep time: -242000s >= -30000s Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe TID: 7152 Thread sleep count: 9229 > 30 Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe TID: 7152 Thread sleep time: -18458000s >= -30000s Jump to behavior
Sample execution stops while process was sleeping (likely an evasion)
Source: C:\Windows\SysWOW64\wevtutil.exe Last function: Thread delayed
Source: C:\Windows\SysWOW64\wevtutil.exe Last function: Thread delayed
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_0040596F CloseHandle,GetTempPathW,DeleteFileW,lstrcatW,lstrcatW,lstrlenW,FindFirstFileW,FindNextFileW,FindClose, 0_2_0040596F
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_004064C1 FindFirstFileW,FindClose, 0_2_004064C1
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_004027FB FindFirstFileW, 0_2_004027FB
Source: a.exe, 00000001.00000003.2617656052.0000000005266000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711990491.0000000005266000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW:;
Source: a.exe, 00000001.00000003.2617656052.0000000005266000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711750941.00000000051F8000.00000004.00000020.00020000.00000000.sdmp, a.exe, 00000001.00000002.2711990491.0000000005266000.00000004.00000020.00020000.00000000.sdmp Binary or memory string: Hyper-V RAW
Source: C:\Users\user\Desktop\a.exe API call chain: ExitProcess graph end node
Source: C:\Users\user\Desktop\a.exe API call chain: ExitProcess graph end node
Source: C:\Windows\SysWOW64\wevtutil.exe Process information queried: ProcessInformation Jump to behavior
Checks if the current process is being debugged
Source: C:\Windows\SysWOW64\wevtutil.exe Process queried: DebugPort Jump to behavior
Contains functionality for execution timing, often used to detect debuggers
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591763 rdtsc 1_2_35591763
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_00402E41 GetTempPathW,GetTickCount,GetModuleFileNameW,GetFileSize,LdrInitializeThunk,GlobalAlloc,CreateFileW,LdrInitializeThunk, 0_2_00402E41
Contains functionality to dynamically determine API calls
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_10001B18 GlobalAlloc,lstrcpyW,lstrcpyW,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,GlobalFree,lstrcpyW,GetModuleHandleW,LoadLibraryW,GetProcAddress,lstrlenW, 0_2_10001B18
Contains functionality to read the PEB
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560B56E mov eax, dword ptr fs:[00000030h] 1_2_3560B56E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560B56E mov ecx, dword ptr fs:[00000030h] 1_2_3560B56E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560B56E mov eax, dword ptr fs:[00000030h] 1_2_3560B56E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D9567 mov eax, dword ptr fs:[00000030h] 1_2_355D9567
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562B55F mov eax, dword ptr fs:[00000030h] 1_2_3562B55F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562B55F mov eax, dword ptr fs:[00000030h] 1_2_3562B55F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35571514 mov eax, dword ptr fs:[00000030h] 1_2_35571514
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35571514 mov eax, dword ptr fs:[00000030h] 1_2_35571514
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35571514 mov eax, dword ptr fs:[00000030h] 1_2_35571514
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35571514 mov eax, dword ptr fs:[00000030h] 1_2_35571514
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35571514 mov eax, dword ptr fs:[00000030h] 1_2_35571514
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35571514 mov eax, dword ptr fs:[00000030h] 1_2_35571514
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov ecx, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov ecx, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FF51B mov eax, dword ptr fs:[00000030h] 1_2_355FF51B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B502 mov eax, dword ptr fs:[00000030h] 1_2_3554B502
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35553536 mov eax, dword ptr fs:[00000030h] 1_2_35553536
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35553536 mov eax, dword ptr fs:[00000030h] 1_2_35553536
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554753F mov eax, dword ptr fs:[00000030h] 1_2_3554753F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554753F mov eax, dword ptr fs:[00000030h] 1_2_3554753F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554753F mov eax, dword ptr fs:[00000030h] 1_2_3554753F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560550D mov eax, dword ptr fs:[00000030h] 1_2_3560550D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560550D mov eax, dword ptr fs:[00000030h] 1_2_3560550D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560550D mov eax, dword ptr fs:[00000030h] 1_2_3560550D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558F523 mov eax, dword ptr fs:[00000030h] 1_2_3558F523
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35581527 mov eax, dword ptr fs:[00000030h] 1_2_35581527
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DB5D3 mov eax, dword ptr fs:[00000030h] 1_2_355DB5D3
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F5C7 mov eax, dword ptr fs:[00000030h] 1_2_3554F5C7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555B5E0 mov eax, dword ptr fs:[00000030h] 1_2_3555B5E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555B5E0 mov eax, dword ptr fs:[00000030h] 1_2_3555B5E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555B5E0 mov eax, dword ptr fs:[00000030h] 1_2_3555B5E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555B5E0 mov eax, dword ptr fs:[00000030h] 1_2_3555B5E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555B5E0 mov eax, dword ptr fs:[00000030h] 1_2_3555B5E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555B5E0 mov eax, dword ptr fs:[00000030h] 1_2_3555B5E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355815EF mov eax, dword ptr fs:[00000030h] 1_2_355815EF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D55E0 mov eax, dword ptr fs:[00000030h] 1_2_355D55E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F7591 mov edi, dword ptr fs:[00000030h] 1_2_355F7591
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FB58B mov eax, dword ptr fs:[00000030h] 1_2_355FB58B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FB58B mov eax, dword ptr fs:[00000030h] 1_2_355FB58B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FB58B mov eax, dword ptr fs:[00000030h] 1_2_355FB58B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FB58B mov eax, dword ptr fs:[00000030h] 1_2_355FB58B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35589580 mov eax, dword ptr fs:[00000030h] 1_2_35589580
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35589580 mov eax, dword ptr fs:[00000030h] 1_2_35589580
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F582 mov eax, dword ptr fs:[00000030h] 1_2_3560F582
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555D454 mov eax, dword ptr fs:[00000030h] 1_2_3555D454
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555D454 mov eax, dword ptr fs:[00000030h] 1_2_3555D454
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555D454 mov eax, dword ptr fs:[00000030h] 1_2_3555D454
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555D454 mov eax, dword ptr fs:[00000030h] 1_2_3555D454
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555D454 mov eax, dword ptr fs:[00000030h] 1_2_3555D454
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555D454 mov eax, dword ptr fs:[00000030h] 1_2_3555D454
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558D450 mov eax, dword ptr fs:[00000030h] 1_2_3558D450
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558D450 mov eax, dword ptr fs:[00000030h] 1_2_3558D450
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F478 mov eax, dword ptr fs:[00000030h] 1_2_3560F478
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35547460 mov eax, dword ptr fs:[00000030h] 1_2_35547460
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35547460 mov eax, dword ptr fs:[00000030h] 1_2_35547460
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560D430 mov eax, dword ptr fs:[00000030h] 1_2_3560D430
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560D430 mov eax, dword ptr fs:[00000030h] 1_2_3560D430
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F409 mov eax, dword ptr fs:[00000030h] 1_2_3560F409
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DF42F mov eax, dword ptr fs:[00000030h] 1_2_355DF42F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DF42F mov eax, dword ptr fs:[00000030h] 1_2_355DF42F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DF42F mov eax, dword ptr fs:[00000030h] 1_2_355DF42F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DF42F mov eax, dword ptr fs:[00000030h] 1_2_355DF42F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DF42F mov eax, dword ptr fs:[00000030h] 1_2_355DF42F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B420 mov eax, dword ptr fs:[00000030h] 1_2_3554B420
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D9429 mov eax, dword ptr fs:[00000030h] 1_2_355D9429
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35587425 mov eax, dword ptr fs:[00000030h] 1_2_35587425
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35587425 mov ecx, dword ptr fs:[00000030h] 1_2_35587425
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355EB420 mov eax, dword ptr fs:[00000030h] 1_2_355EB420
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355EB420 mov eax, dword ptr fs:[00000030h] 1_2_355EB420
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F4D0 mov eax, dword ptr fs:[00000030h] 1_2_3557F4D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F4FD mov eax, dword ptr fs:[00000030h] 1_2_3560F4FD
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355714C9 mov eax, dword ptr fs:[00000030h] 1_2_355714C9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355714C9 mov eax, dword ptr fs:[00000030h] 1_2_355714C9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355714C9 mov eax, dword ptr fs:[00000030h] 1_2_355714C9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355714C9 mov eax, dword ptr fs:[00000030h] 1_2_355714C9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355714C9 mov eax, dword ptr fs:[00000030h] 1_2_355714C9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355794FA mov eax, dword ptr fs:[00000030h] 1_2_355794FA
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355854E0 mov eax, dword ptr fs:[00000030h] 1_2_355854E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558B490 mov eax, dword ptr fs:[00000030h] 1_2_3558B490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558B490 mov eax, dword ptr fs:[00000030h] 1_2_3558B490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F5490 mov eax, dword ptr fs:[00000030h] 1_2_355F5490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F5490 mov eax, dword ptr fs:[00000030h] 1_2_355F5490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F5490 mov eax, dword ptr fs:[00000030h] 1_2_355F5490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F5490 mov eax, dword ptr fs:[00000030h] 1_2_355F5490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F5490 mov eax, dword ptr fs:[00000030h] 1_2_355F5490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F5490 mov eax, dword ptr fs:[00000030h] 1_2_355F5490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F5490 mov eax, dword ptr fs:[00000030h] 1_2_355F5490
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356054B0 mov eax, dword ptr fs:[00000030h] 1_2_356054B0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356054B0 mov ecx, dword ptr fs:[00000030h] 1_2_356054B0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DD4A0 mov ecx, dword ptr fs:[00000030h] 1_2_355DD4A0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DD4A0 mov eax, dword ptr fs:[00000030h] 1_2_355DD4A0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DD4A0 mov eax, dword ptr fs:[00000030h] 1_2_355DD4A0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F75B mov eax, dword ptr fs:[00000030h] 1_2_3554F75B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558174A mov eax, dword ptr fs:[00000030h] 1_2_3558174A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F773 mov eax, dword ptr fs:[00000030h] 1_2_3560F773
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D174B mov eax, dword ptr fs:[00000030h] 1_2_355D174B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D174B mov ecx, dword ptr fs:[00000030h] 1_2_355D174B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35583740 mov eax, dword ptr fs:[00000030h] 1_2_35583740
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591763 mov eax, dword ptr fs:[00000030h] 1_2_35591763
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591763 mov eax, dword ptr fs:[00000030h] 1_2_35591763
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591763 mov eax, dword ptr fs:[00000030h] 1_2_35591763
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591763 mov eax, dword ptr fs:[00000030h] 1_2_35591763
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591763 mov eax, dword ptr fs:[00000030h] 1_2_35591763
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591763 mov eax, dword ptr fs:[00000030h] 1_2_35591763
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B705 mov eax, dword ptr fs:[00000030h] 1_2_3554B705
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B705 mov eax, dword ptr fs:[00000030h] 1_2_3554B705
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B705 mov eax, dword ptr fs:[00000030h] 1_2_3554B705
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B705 mov eax, dword ptr fs:[00000030h] 1_2_3554B705
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555D700 mov ecx, dword ptr fs:[00000030h] 1_2_3555D700
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555170C mov eax, dword ptr fs:[00000030h] 1_2_3555170C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555170C mov eax, dword ptr fs:[00000030h] 1_2_3555170C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555170C mov eax, dword ptr fs:[00000030h] 1_2_3555170C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623700 mov eax, dword ptr fs:[00000030h] 1_2_35623700
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623700 mov eax, dword ptr fs:[00000030h] 1_2_35623700
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623700 mov eax, dword ptr fs:[00000030h] 1_2_35623700
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561970B mov eax, dword ptr fs:[00000030h] 1_2_3561970B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561970B mov eax, dword ptr fs:[00000030h] 1_2_3561970B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35553722 mov eax, dword ptr fs:[00000030h] 1_2_35553722
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35553722 mov eax, dword ptr fs:[00000030h] 1_2_35553722
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F717 mov eax, dword ptr fs:[00000030h] 1_2_3560F717
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355577F9 mov eax, dword ptr fs:[00000030h] 1_2_355577F9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355577F9 mov eax, dword ptr fs:[00000030h] 1_2_355577F9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F7CF mov eax, dword ptr fs:[00000030h] 1_2_3560F7CF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355537E4 mov eax, dword ptr fs:[00000030h] 1_2_355537E4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355537E4 mov eax, dword ptr fs:[00000030h] 1_2_355537E4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355537E4 mov eax, dword ptr fs:[00000030h] 1_2_355537E4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355537E4 mov eax, dword ptr fs:[00000030h] 1_2_355537E4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355537E4 mov eax, dword ptr fs:[00000030h] 1_2_355537E4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355537E4 mov eax, dword ptr fs:[00000030h] 1_2_355537E4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355537E4 mov eax, dword ptr fs:[00000030h] 1_2_355537E4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561D7A7 mov eax, dword ptr fs:[00000030h] 1_2_3561D7A7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561D7A7 mov eax, dword ptr fs:[00000030h] 1_2_3561D7A7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561D7A7 mov eax, dword ptr fs:[00000030h] 1_2_3561D7A7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35581796 mov eax, dword ptr fs:[00000030h] 1_2_35581796
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35581796 mov eax, dword ptr fs:[00000030h] 1_2_35581796
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356217BC mov eax, dword ptr fs:[00000030h] 1_2_356217BC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562B781 mov eax, dword ptr fs:[00000030h] 1_2_3562B781
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562B781 mov eax, dword ptr fs:[00000030h] 1_2_3562B781
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556B650 mov ecx, dword ptr fs:[00000030h] 1_2_3556B650
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556B650 mov eax, dword ptr fs:[00000030h] 1_2_3556B650
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556B650 mov eax, dword ptr fs:[00000030h] 1_2_3556B650
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556B650 mov eax, dword ptr fs:[00000030h] 1_2_3556B650
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556B650 mov eax, dword ptr fs:[00000030h] 1_2_3556B650
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35585654 mov eax, dword ptr fs:[00000030h] 1_2_35585654
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35553640 mov eax, dword ptr fs:[00000030h] 1_2_35553640
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F640 mov eax, dword ptr fs:[00000030h] 1_2_3556F640
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F640 mov eax, dword ptr fs:[00000030h] 1_2_3556F640
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F640 mov eax, dword ptr fs:[00000030h] 1_2_3556F640
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554D64A mov eax, dword ptr fs:[00000030h] 1_2_3554D64A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554D64A mov eax, dword ptr fs:[00000030h] 1_2_3554D64A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D166E mov eax, dword ptr fs:[00000030h] 1_2_355D166E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D166E mov eax, dword ptr fs:[00000030h] 1_2_355D166E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D166E mov eax, dword ptr fs:[00000030h] 1_2_355D166E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35547662 mov eax, dword ptr fs:[00000030h] 1_2_35547662
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35547662 mov eax, dword ptr fs:[00000030h] 1_2_35547662
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35547662 mov eax, dword ptr fs:[00000030h] 1_2_35547662
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E5660 mov eax, dword ptr fs:[00000030h] 1_2_355E5660
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35601623 mov eax, dword ptr fs:[00000030h] 1_2_35601623
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35601623 mov eax, dword ptr fs:[00000030h] 1_2_35601623
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35601623 mov eax, dword ptr fs:[00000030h] 1_2_35601623
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E3608 mov eax, dword ptr fs:[00000030h] 1_2_355E3608
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E3608 mov eax, dword ptr fs:[00000030h] 1_2_355E3608
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E3608 mov eax, dword ptr fs:[00000030h] 1_2_355E3608
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E3608 mov eax, dword ptr fs:[00000030h] 1_2_355E3608
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E3608 mov eax, dword ptr fs:[00000030h] 1_2_355E3608
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E3608 mov eax, dword ptr fs:[00000030h] 1_2_355E3608
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557D600 mov eax, dword ptr fs:[00000030h] 1_2_3557D600
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557D600 mov eax, dword ptr fs:[00000030h] 1_2_3557D600
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558360F mov eax, dword ptr fs:[00000030h] 1_2_3558360F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D9603 mov eax, dword ptr fs:[00000030h] 1_2_355D9603
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558F63F mov eax, dword ptr fs:[00000030h] 1_2_3558F63F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558F63F mov eax, dword ptr fs:[00000030h] 1_2_3558F63F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F607 mov eax, dword ptr fs:[00000030h] 1_2_3560F607
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FD62C mov ecx, dword ptr fs:[00000030h] 1_2_355FD62C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FD62C mov ecx, dword ptr fs:[00000030h] 1_2_355FD62C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FD62C mov eax, dword ptr fs:[00000030h] 1_2_355FD62C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35557623 mov eax, dword ptr fs:[00000030h] 1_2_35557623
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35555622 mov eax, dword ptr fs:[00000030h] 1_2_35555622
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35555622 mov eax, dword ptr fs:[00000030h] 1_2_35555622
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557D6D0 mov eax, dword ptr fs:[00000030h] 1_2_3557D6D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355496E0 mov eax, dword ptr fs:[00000030h] 1_2_355496E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355496E0 mov eax, dword ptr fs:[00000030h] 1_2_355496E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355556E0 mov eax, dword ptr fs:[00000030h] 1_2_355556E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355556E0 mov eax, dword ptr fs:[00000030h] 1_2_355556E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355556E0 mov eax, dword ptr fs:[00000030h] 1_2_355556E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E56E0 mov eax, dword ptr fs:[00000030h] 1_2_355E56E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E56E0 mov eax, dword ptr fs:[00000030h] 1_2_355E56E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F36E0 mov eax, dword ptr fs:[00000030h] 1_2_355F36E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F36E0 mov eax, dword ptr fs:[00000030h] 1_2_355F36E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F36E0 mov eax, dword ptr fs:[00000030h] 1_2_355F36E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F36E0 mov eax, dword ptr fs:[00000030h] 1_2_355F36E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F36E0 mov eax, dword ptr fs:[00000030h] 1_2_355F36E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CD69D mov eax, dword ptr fs:[00000030h] 1_2_355CD69D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F68C mov eax, dword ptr fs:[00000030h] 1_2_3560F68C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623690 mov eax, dword ptr fs:[00000030h] 1_2_35623690
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E314A mov eax, dword ptr fs:[00000030h] 1_2_355E314A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E314A mov eax, dword ptr fs:[00000030h] 1_2_355E314A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E314A mov eax, dword ptr fs:[00000030h] 1_2_355E314A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E314A mov eax, dword ptr fs:[00000030h] 1_2_355E314A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355ED140 mov eax, dword ptr fs:[00000030h] 1_2_355ED140
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355ED140 mov eax, dword ptr fs:[00000030h] 1_2_355ED140
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355A717A mov eax, dword ptr fs:[00000030h] 1_2_355A717A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355A717A mov eax, dword ptr fs:[00000030h] 1_2_355A717A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35625149 mov eax, dword ptr fs:[00000030h] 1_2_35625149
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623157 mov eax, dword ptr fs:[00000030h] 1_2_35623157
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623157 mov eax, dword ptr fs:[00000030h] 1_2_35623157
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623157 mov eax, dword ptr fs:[00000030h] 1_2_35623157
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623157 mov eax, dword ptr fs:[00000030h] 1_2_35623157
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558716D mov eax, dword ptr fs:[00000030h] 1_2_3558716D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554F113 mov eax, dword ptr fs:[00000030h] 1_2_3554F113
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623136 mov eax, dword ptr fs:[00000030h] 1_2_35623136
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555510D mov eax, dword ptr fs:[00000030h] 1_2_3555510D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557510F mov eax, dword ptr fs:[00000030h] 1_2_3557510F
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F13E mov eax, dword ptr fs:[00000030h] 1_2_3560F13E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35587128 mov eax, dword ptr fs:[00000030h] 1_2_35587128
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35587128 mov eax, dword ptr fs:[00000030h] 1_2_35587128
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355651C0 mov eax, dword ptr fs:[00000030h] 1_2_355651C0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355651C0 mov eax, dword ptr fs:[00000030h] 1_2_355651C0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355651C0 mov eax, dword ptr fs:[00000030h] 1_2_355651C0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355651C0 mov eax, dword ptr fs:[00000030h] 1_2_355651C0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355491F0 mov eax, dword ptr fs:[00000030h] 1_2_355491F0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355491F0 mov eax, dword ptr fs:[00000030h] 1_2_355491F0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F1F0 mov eax, dword ptr fs:[00000030h] 1_2_3557F1F0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F1F0 mov eax, dword ptr fs:[00000030h] 1_2_3557F1F0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355ED1F0 mov eax, dword ptr fs:[00000030h] 1_2_355ED1F0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355591E5 mov eax, dword ptr fs:[00000030h] 1_2_355591E5
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355591E5 mov eax, dword ptr fs:[00000030h] 1_2_355591E5
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35579194 mov eax, dword ptr fs:[00000030h] 1_2_35579194
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591190 mov eax, dword ptr fs:[00000030h] 1_2_35591190
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35591190 mov eax, dword ptr fs:[00000030h] 1_2_35591190
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356251B6 mov eax, dword ptr fs:[00000030h] 1_2_356251B6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355831BE mov eax, dword ptr fs:[00000030h] 1_2_355831BE
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355831BE mov eax, dword ptr fs:[00000030h] 1_2_355831BE
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551051 mov eax, dword ptr fs:[00000030h] 1_2_35551051
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551051 mov eax, dword ptr fs:[00000030h] 1_2_35551051
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35621076 mov eax, dword ptr fs:[00000030h] 1_2_35621076
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35621076 mov eax, dword ptr fs:[00000030h] 1_2_35621076
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35557072 mov eax, dword ptr fs:[00000030h] 1_2_35557072
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562505B mov eax, dword ptr fs:[00000030h] 1_2_3562505B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F9060 mov eax, dword ptr fs:[00000030h] 1_2_355F9060
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35575004 mov eax, dword ptr fs:[00000030h] 1_2_35575004
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35575004 mov ecx, dword ptr fs:[00000030h] 1_2_35575004
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F7030 mov eax, dword ptr fs:[00000030h] 1_2_355F7030
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554D02D mov eax, dword ptr fs:[00000030h] 1_2_3554D02D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B0D6 mov eax, dword ptr fs:[00000030h] 1_2_3554B0D6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B0D6 mov eax, dword ptr fs:[00000030h] 1_2_3554B0D6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B0D6 mov eax, dword ptr fs:[00000030h] 1_2_3554B0D6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B0D6 mov eax, dword ptr fs:[00000030h] 1_2_3554B0D6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556B0D0 mov eax, dword ptr fs:[00000030h] 1_2_3556B0D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FB0D0 mov eax, dword ptr fs:[00000030h] 1_2_355FB0D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FB0D0 mov eax, dword ptr fs:[00000030h] 1_2_355FB0D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FB0D0 mov eax, dword ptr fs:[00000030h] 1_2_355FB0D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558D0F0 mov eax, dword ptr fs:[00000030h] 1_2_3558D0F0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558D0F0 mov ecx, dword ptr fs:[00000030h] 1_2_3558D0F0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355490F8 mov eax, dword ptr fs:[00000030h] 1_2_355490F8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355490F8 mov eax, dword ptr fs:[00000030h] 1_2_355490F8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355490F8 mov eax, dword ptr fs:[00000030h] 1_2_355490F8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355490F8 mov eax, dword ptr fs:[00000030h] 1_2_355490F8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D7090 mov eax, dword ptr fs:[00000030h] 1_2_355D7090
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560B0AF mov eax, dword ptr fs:[00000030h] 1_2_3560B0AF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356250B7 mov eax, dword ptr fs:[00000030h] 1_2_356250B7
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560D330 mov eax, dword ptr fs:[00000030h] 1_2_3560D330
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560D330 mov eax, dword ptr fs:[00000030h] 1_2_3560D330
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623336 mov eax, dword ptr fs:[00000030h] 1_2_35623336
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35549303 mov eax, dword ptr fs:[00000030h] 1_2_35549303
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35549303 mov eax, dword ptr fs:[00000030h] 1_2_35549303
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F30A mov eax, dword ptr fs:[00000030h] 1_2_3560F30A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557332D mov eax, dword ptr fs:[00000030h] 1_2_3557332D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355833D0 mov eax, dword ptr fs:[00000030h] 1_2_355833D0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F1390 mov eax, dword ptr fs:[00000030h] 1_2_355F1390
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F1390 mov eax, dword ptr fs:[00000030h] 1_2_355F1390
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551380 mov eax, dword ptr fs:[00000030h] 1_2_35551380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551380 mov eax, dword ptr fs:[00000030h] 1_2_35551380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551380 mov eax, dword ptr fs:[00000030h] 1_2_35551380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551380 mov eax, dword ptr fs:[00000030h] 1_2_35551380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551380 mov eax, dword ptr fs:[00000030h] 1_2_35551380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F380 mov eax, dword ptr fs:[00000030h] 1_2_3556F380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F380 mov eax, dword ptr fs:[00000030h] 1_2_3556F380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F380 mov eax, dword ptr fs:[00000030h] 1_2_3556F380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F380 mov eax, dword ptr fs:[00000030h] 1_2_3556F380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F380 mov eax, dword ptr fs:[00000030h] 1_2_3556F380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556F380 mov eax, dword ptr fs:[00000030h] 1_2_3556F380
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F38A mov eax, dword ptr fs:[00000030h] 1_2_3560F38A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355593A6 mov eax, dword ptr fs:[00000030h] 1_2_355593A6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355593A6 mov eax, dword ptr fs:[00000030h] 1_2_355593A6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CD250 mov eax, dword ptr fs:[00000030h] 1_2_355CD250
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CD250 mov ecx, dword ptr fs:[00000030h] 1_2_355CD250
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560D270 mov eax, dword ptr fs:[00000030h] 1_2_3560D270
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557F24A mov eax, dword ptr fs:[00000030h] 1_2_3557F24A
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F247 mov eax, dword ptr fs:[00000030h] 1_2_3560F247
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B273 mov eax, dword ptr fs:[00000030h] 1_2_3554B273
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B273 mov eax, dword ptr fs:[00000030h] 1_2_3554B273
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554B273 mov eax, dword ptr fs:[00000030h] 1_2_3554B273
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561124C mov eax, dword ptr fs:[00000030h] 1_2_3561124C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561124C mov eax, dword ptr fs:[00000030h] 1_2_3561124C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561124C mov eax, dword ptr fs:[00000030h] 1_2_3561124C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3561124C mov eax, dword ptr fs:[00000030h] 1_2_3561124C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DB214 mov eax, dword ptr fs:[00000030h] 1_2_355DB214
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355DB214 mov eax, dword ptr fs:[00000030h] 1_2_355DB214
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F32DF mov eax, dword ptr fs:[00000030h] 1_2_355F32DF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F32DF mov eax, dword ptr fs:[00000030h] 1_2_355F32DF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F32DF mov eax, dword ptr fs:[00000030h] 1_2_355F32DF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F32DF mov eax, dword ptr fs:[00000030h] 1_2_355F32DF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F32DF mov eax, dword ptr fs:[00000030h] 1_2_355F32DF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355732C5 mov eax, dword ptr fs:[00000030h] 1_2_355732C5
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355472E0 mov eax, dword ptr fs:[00000030h] 1_2_355472E0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554D2EC mov eax, dword ptr fs:[00000030h] 1_2_3554D2EC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554D2EC mov eax, dword ptr fs:[00000030h] 1_2_3554D2EC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35557290 mov eax, dword ptr fs:[00000030h] 1_2_35557290
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35557290 mov eax, dword ptr fs:[00000030h] 1_2_35557290
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35557290 mov eax, dword ptr fs:[00000030h] 1_2_35557290
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_356192AB mov eax, dword ptr fs:[00000030h] 1_2_356192AB
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560F2AE mov eax, dword ptr fs:[00000030h] 1_2_3560F2AE
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562B2BC mov eax, dword ptr fs:[00000030h] 1_2_3562B2BC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562B2BC mov eax, dword ptr fs:[00000030h] 1_2_3562B2BC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562B2BC mov eax, dword ptr fs:[00000030h] 1_2_3562B2BC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3562B2BC mov eax, dword ptr fs:[00000030h] 1_2_3562B2BC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355492AF mov eax, dword ptr fs:[00000030h] 1_2_355492AF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1D5E mov eax, dword ptr fs:[00000030h] 1_2_355D1D5E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551D50 mov eax, dword ptr fs:[00000030h] 1_2_35551D50
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551D50 mov eax, dword ptr fs:[00000030h] 1_2_35551D50
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35625D65 mov eax, dword ptr fs:[00000030h] 1_2_35625D65
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35549D46 mov eax, dword ptr fs:[00000030h] 1_2_35549D46
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35549D46 mov eax, dword ptr fs:[00000030h] 1_2_35549D46
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35549D46 mov ecx, dword ptr fs:[00000030h] 1_2_35549D46
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DD4D mov eax, dword ptr fs:[00000030h] 1_2_3556DD4D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DD4D mov eax, dword ptr fs:[00000030h] 1_2_3556DD4D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DD4D mov eax, dword ptr fs:[00000030h] 1_2_3556DD4D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35615D43 mov eax, dword ptr fs:[00000030h] 1_2_35615D43
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35615D43 mov eax, dword ptr fs:[00000030h] 1_2_35615D43
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558BD71 mov eax, dword ptr fs:[00000030h] 1_2_3558BD71
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558BD71 mov eax, dword ptr fs:[00000030h] 1_2_3558BD71
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35565D60 mov eax, dword ptr fs:[00000030h] 1_2_35565D60
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D5D60 mov eax, dword ptr fs:[00000030h] 1_2_355D5D60
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35621D2E mov eax, dword ptr fs:[00000030h] 1_2_35621D2E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F3D00 mov eax, dword ptr fs:[00000030h] 1_2_355F3D00
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355F3D00 mov eax, dword ptr fs:[00000030h] 1_2_355F3D00
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560BD08 mov eax, dword ptr fs:[00000030h] 1_2_3560BD08
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560BD08 mov eax, dword ptr fs:[00000030h] 1_2_3560BD08
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558BD37 mov eax, dword ptr fs:[00000030h] 1_2_3558BD37
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554FD20 mov eax, dword ptr fs:[00000030h] 1_2_3554FD20
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FFDF4 mov eax, dword ptr fs:[00000030h] 1_2_355FFDF4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35609DD0 mov eax, dword ptr fs:[00000030h] 1_2_35609DD0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35609DD0 mov eax, dword ptr fs:[00000030h] 1_2_35609DD0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555BDE0 mov eax, dword ptr fs:[00000030h] 1_2_3555BDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555BDE0 mov eax, dword ptr fs:[00000030h] 1_2_3555BDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555BDE0 mov eax, dword ptr fs:[00000030h] 1_2_3555BDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555BDE0 mov eax, dword ptr fs:[00000030h] 1_2_3555BDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555BDE0 mov eax, dword ptr fs:[00000030h] 1_2_3555BDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555BDE0 mov eax, dword ptr fs:[00000030h] 1_2_3555BDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555BDE0 mov eax, dword ptr fs:[00000030h] 1_2_3555BDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3555BDE0 mov eax, dword ptr fs:[00000030h] 1_2_3555BDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3557FDE0 mov eax, dword ptr fs:[00000030h] 1_2_3557FDE0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35557DB6 mov eax, dword ptr fs:[00000030h] 1_2_35557DB6
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554DDB0 mov eax, dword ptr fs:[00000030h] 1_2_3554DDB0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D3C57 mov eax, dword ptr fs:[00000030h] 1_2_355D3C57
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554DC40 mov eax, dword ptr fs:[00000030h] 1_2_3554DC40
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35563C40 mov eax, dword ptr fs:[00000030h] 1_2_35563C40
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558BC6E mov eax, dword ptr fs:[00000030h] 1_2_3558BC6E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558BC6E mov eax, dword ptr fs:[00000030h] 1_2_3558BC6E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35615C38 mov eax, dword ptr fs:[00000030h] 1_2_35615C38
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35615C38 mov ecx, dword ptr fs:[00000030h] 1_2_35615C38
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E7C38 mov eax, dword ptr fs:[00000030h] 1_2_355E7C38
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35563C20 mov eax, dword ptr fs:[00000030h] 1_2_35563C20
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623CE4 mov eax, dword ptr fs:[00000030h] 1_2_35623CE4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35623CE4 mov eax, dword ptr fs:[00000030h] 1_2_35623CE4
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DCD1 mov eax, dword ptr fs:[00000030h] 1_2_3556DCD1
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DCD1 mov eax, dword ptr fs:[00000030h] 1_2_3556DCD1
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DCD1 mov eax, dword ptr fs:[00000030h] 1_2_3556DCD1
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D5CD0 mov eax, dword ptr fs:[00000030h] 1_2_355D5CD0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35589CCF mov eax, dword ptr fs:[00000030h] 1_2_35589CCF
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35547CF1 mov eax, dword ptr fs:[00000030h] 1_2_35547CF1
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35553CF0 mov eax, dword ptr fs:[00000030h] 1_2_35553CF0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35553CF0 mov eax, dword ptr fs:[00000030h] 1_2_35553CF0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355E7CE8 mov eax, dword ptr fs:[00000030h] 1_2_355E7CE8
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35557C95 mov eax, dword ptr fs:[00000030h] 1_2_35557C95
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35557C95 mov eax, dword ptr fs:[00000030h] 1_2_35557C95
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov eax, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov ecx, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov eax, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov eax, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov ecx, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov eax, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov eax, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov ecx, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov eax, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDC8E mov ecx, dword ptr fs:[00000030h] 1_2_355FDC8E
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D3C80 mov ecx, dword ptr fs:[00000030h] 1_2_355D3C80
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560FC95 mov eax, dword ptr fs:[00000030h] 1_2_3560FC95
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDF5B mov eax, dword ptr fs:[00000030h] 1_2_355FDF5B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDF5B mov eax, dword ptr fs:[00000030h] 1_2_355FDF5B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDF5B mov ecx, dword ptr fs:[00000030h] 1_2_355FDF5B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355FDF5B mov eax, dword ptr fs:[00000030h] 1_2_355FDF5B
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554BF70 mov eax, dword ptr fs:[00000030h] 1_2_3554BF70
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35551F70 mov eax, dword ptr fs:[00000030h] 1_2_35551F70
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3560BF4D mov eax, dword ptr fs:[00000030h] 1_2_3560BF4D
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558BF0C mov eax, dword ptr fs:[00000030h] 1_2_3558BF0C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558BF0C mov eax, dword ptr fs:[00000030h] 1_2_3558BF0C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3558BF0C mov eax, dword ptr fs:[00000030h] 1_2_3558BF0C
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFF03 mov eax, dword ptr fs:[00000030h] 1_2_355CFF03
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFF03 mov eax, dword ptr fs:[00000030h] 1_2_355CFF03
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFF03 mov eax, dword ptr fs:[00000030h] 1_2_355CFF03
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DF36 mov eax, dword ptr fs:[00000030h] 1_2_3556DF36
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DF36 mov eax, dword ptr fs:[00000030h] 1_2_3556DF36
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DF36 mov eax, dword ptr fs:[00000030h] 1_2_3556DF36
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3556DF36 mov eax, dword ptr fs:[00000030h] 1_2_3556DF36
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554FF30 mov edi, dword ptr fs:[00000030h] 1_2_3554FF30
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFFDC mov eax, dword ptr fs:[00000030h] 1_2_355CFFDC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFFDC mov eax, dword ptr fs:[00000030h] 1_2_355CFFDC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFFDC mov eax, dword ptr fs:[00000030h] 1_2_355CFFDC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFFDC mov ecx, dword ptr fs:[00000030h] 1_2_355CFFDC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFFDC mov eax, dword ptr fs:[00000030h] 1_2_355CFFDC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355CFFDC mov eax, dword ptr fs:[00000030h] 1_2_355CFFDC
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_35549FD0 mov eax, dword ptr fs:[00000030h] 1_2_35549FD0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_3554BFC0 mov eax, dword ptr fs:[00000030h] 1_2_3554BFC0
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1FC9 mov eax, dword ptr fs:[00000030h] 1_2_355D1FC9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1FC9 mov eax, dword ptr fs:[00000030h] 1_2_355D1FC9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1FC9 mov eax, dword ptr fs:[00000030h] 1_2_355D1FC9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1FC9 mov eax, dword ptr fs:[00000030h] 1_2_355D1FC9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1FC9 mov eax, dword ptr fs:[00000030h] 1_2_355D1FC9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1FC9 mov eax, dword ptr fs:[00000030h] 1_2_355D1FC9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1FC9 mov eax, dword ptr fs:[00000030h] 1_2_355D1FC9
Source: C:\Users\user\Desktop\a.exe Code function: 1_2_355D1FC9 mov eax, dword ptr fs:[00000030h] 1_2_355D1FC9

HIPS / PFW / Operating System Protection Evasion
barindex
Found direct / indirect Syscall (likely to bypass EDR)
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtOpenFile: Direct from: 0x76FE2CEC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtOpenKeyEx: Direct from: 0x76FE3BBC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtQueryVolumeInformationFile: Direct from: 0x76FE2E4C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtQueryValueKey: Direct from: 0x76FE2B0C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtOpenSection: Direct from: 0x76FE2D2C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtCreateFile: Direct from: 0x76FE2F0C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtSetInformationProcess: Direct from: 0x76FE2B7C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtNotifyChangeKey: Direct from: 0x76FE3B4C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtWriteVirtualMemory: Direct from: 0x76FE2D5C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtMapViewOfSection: Direct from: 0x76FE2C3C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtReadVirtualMemory: Direct from: 0x76FE2DAC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtDelayExecution: Direct from: 0x76FE2CFC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtOpenKeyEx: Direct from: 0x76FE2ABC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtAllocateVirtualMemory: Direct from: 0x76FE2B1C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtReadFile: Direct from: 0x76FE29FC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtQuerySystemInformation: Direct from: 0x76FE2D1C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtClose: Direct from: 0x76FE2A8C
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtQueryAttributesFile: Direct from: 0x76FE2D8C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtQuerySystemInformation: Direct from: 0x76FE47EC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtQueryInformationProcess: Direct from: 0x76FE2B46 Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtResumeThread: Direct from: 0x76FE2EDC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtCreateUserProcess: Direct from: 0x76FE363C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtWriteVirtualMemory: Direct from: 0x76FE482C Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtProtectVirtualMemory: Direct from: 0x76FE2EBC Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe NtAllocateVirtualMemory: Direct from: 0x76FE480C Jump to behavior
Maps a DLL or memory area into another process
Source: C:\Users\user\Desktop\a.exe Section loaded: NULL target: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe protection: execute and read and write Jump to behavior
Source: C:\Users\user\Desktop\a.exe Section loaded: NULL target: C:\Windows\SysWOW64\wevtutil.exe protection: execute and read and write Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe Section loaded: NULL target: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe protection: read write Jump to behavior
Source: C:\Windows\SysWOW64\wevtutil.exe Section loaded: NULL target: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe protection: execute and read and write Jump to behavior
Queues an APC in another process (thread injection)
Source: C:\Windows\SysWOW64\wevtutil.exe Thread APC queued: target process: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Jump to behavior
Creates a process in suspended mode (likely to inject code)
Source: C:\Users\user\Desktop\a.exe Process created: C:\Users\user\Desktop\a.exe "C:\Users\user\Desktop\a.exe" Jump to behavior
Source: C:\Program Files (x86)\vdMeXjzUHkjyzgCaRoWCAuDAyxnRKseZLSzAdUYFFCGKCBnRBzsjethVWjGBneJ\DQQJUqjNpfsuRoehxlGNlXd.exe Process created: C:\Windows\SysWOW64\wevtutil.exe "C:\Windows\SysWOW64\wevtutil.exe" Jump to behavior
Source: C:\Users\user\Desktop\a.exe Code function: 0_2_004061A0 GetVersion,GetSystemDirectoryW,GetWindowsDirectoryW,SHGetSpecialFolderLocation,SHGetPathFromIDListW,CoTaskMemFree,lstrcatW,lstrlenW, 0_2_004061A0

Stealing of Sensitive Information
barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.4099056387.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4098989779.0000000000D90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2698538356.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2723097788.0000000036270000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4099145060.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4098489075.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4100016016.0000000003A90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY

Remote Access Functionality
barindex
Yara detected FormBook
Source: Yara match File source: 00000004.00000002.4099056387.0000000002C00000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000005.00000002.4098989779.0000000000D90000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2698538356.00000000000A0000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000001.00000002.2723097788.0000000036270000.00000040.10000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4099145060.0000000002C40000.00000004.00000800.00020000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000004.00000002.4098489075.00000000003C0000.00000040.80000000.00040000.00000000.sdmp, type: MEMORY
Source: Yara match File source: 00000003.00000002.4100016016.0000000003A90000.00000040.00000001.00040000.00000000.sdmp, type: MEMORY
windows-stand
Hide Legend

Legend:

  • Process
  • Signature
  • Created File
  • DNS/IP Info
  • Is Dropped
  • Is Windows Process
  • Number of created Registry Values
  • Number of created Files
  • Visual Basic
  • Delphi
  • Java
  • .Net C# or VB.NET
  • C, C++ or other language
  • Is malicious
  • Internet
behaviorgraph top1 dnsIp2 2 Behavior Graph ID: 1435820 Sample: a.exe Startdate: 03/05/2024 Architecture: WINDOWS Score: 100 28 www.nurse-job2535.life 2->28 30 www.benappetit.co.uk 2->30 32 2 other IPs or domains 2->32 40 Snort IDS alert for network traffic 2->40 42 Multi AV Scanner detection for domain / URL 2->42 44 Malicious sample detected (through community Yara rule) 2->44 46 3 other signatures 2->46 10 a.exe 1 38 2->10         started        signatures3 process4 file5 26 C:\Users\user\AppData\Local\...\System.dll, PE32 10->26 dropped 13 a.exe 6 10->13         started        process6 dnsIp7 34 drive.google.com 142.250.31.102, 443, 49792 GOOGLEUS United States 13->34 36 drive.usercontent.google.com 172.253.122.132, 443, 49793 GOOGLEUS United States 13->36 54 Maps a DLL or memory area into another process 13->54 17 DQQJUqjNpfsuRoehxlGNlXd.exe 13->17 injected signatures8 process9 signatures10 38 Found direct / indirect Syscall (likely to bypass EDR) 17->38 20 wevtutil.exe 17->20         started        process11 signatures12 48 Maps a DLL or memory area into another process 20->48 50 Queues an APC in another process (thread injection) 20->50 23 DQQJUqjNpfsuRoehxlGNlXd.exe 20->23 injected process13 signatures14 52 Found direct / indirect Syscall (likely to bypass EDR) 23->52
  • No. of IPs < 25%
  • 25% < No. of IPs < 50%
  • 50% < No. of IPs < 75%
  • 75% < No. of IPs

Contacted Public IPs

IP Domain Country Flag ASN ASN Name Malicious
142.250.31.102
 drive.google.com United States
15169 GOOGLEUS false
172.253.122.132
 drive.usercontent.google.com United States
15169 GOOGLEUS false

Contacted Domains

Name IP Active
www.benappetit.co.uk 213.171.195.105 true
drive.google.com 142.250.31.102 true
drive.usercontent.google.com 172.253.122.132 true
www.nurse-job2535.life 64.190.62.22 true